WO2022147804A1 - 一种密钥标识的生成方法以及相关装置 - Google Patents
一种密钥标识的生成方法以及相关装置 Download PDFInfo
- Publication number
- WO2022147804A1 WO2022147804A1 PCT/CN2021/070980 CN2021070980W WO2022147804A1 WO 2022147804 A1 WO2022147804 A1 WO 2022147804A1 CN 2021070980 W CN2021070980 W CN 2021070980W WO 2022147804 A1 WO2022147804 A1 WO 2022147804A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- authentication
- identifier
- management function
- key
- request message
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 167
- 238000007726 management method Methods 0.000 claims abstract description 291
- 230000004044 response Effects 0.000 claims abstract description 232
- 238000013523 data management Methods 0.000 claims abstract description 84
- 230000008569 process Effects 0.000 claims abstract description 58
- 230000006870 function Effects 0.000 claims description 356
- 238000004891 communication Methods 0.000 claims description 113
- 238000012545 processing Methods 0.000 claims description 78
- 238000004590 computer program Methods 0.000 claims description 21
- 238000010586 diagram Methods 0.000 description 24
- 238000013475 authorization Methods 0.000 description 9
- 238000001514 detection method Methods 0.000 description 9
- 230000005540 biological transmission Effects 0.000 description 6
- 238000005516 engineering process Methods 0.000 description 6
- 230000007774 longterm Effects 0.000 description 6
- 238000012986 modification Methods 0.000 description 4
- 230000004048 modification Effects 0.000 description 4
- 238000011161 development Methods 0.000 description 3
- 238000010295 mobile communication Methods 0.000 description 3
- 230000001413 cellular effect Effects 0.000 description 2
- 230000008878 coupling Effects 0.000 description 2
- 238000010168 coupling process Methods 0.000 description 2
- 238000005859 coupling reaction Methods 0.000 description 2
- 238000013461 design Methods 0.000 description 2
- 230000014509 gene expression Effects 0.000 description 2
- 230000002452 interceptive effect Effects 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 238000012546 transfer Methods 0.000 description 2
- 238000012795 verification Methods 0.000 description 2
- 101150119040 Nsmf gene Proteins 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 238000013528 artificial neural network Methods 0.000 description 1
- 230000003190 augmentative effect Effects 0.000 description 1
- 239000003795 chemical substances by application Substances 0.000 description 1
- 235000014510 cooky Nutrition 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 230000000977 initiatory effect Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 230000011664 signaling Effects 0.000 description 1
- 239000002699 waste material Substances 0.000 description 1
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/041—Key generation or derivation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
- H04W12/0431—Key distribution or pre-distribution; Key agreement
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
- H04W12/0433—Key management protocols
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
Definitions
- the present application relates to the field of communication technologies, and in particular, to a method for generating a key identifier and a related device.
- AKMA authentication and key management
- UE user equipment
- AF application function
- AKMA application authentication and key management
- UDM Unified Data Management
- the authentication vector acquisition request message carries the Permanent identity identifier (subscriber permanent identifier, SUPI) or subscription concealed identifier (subscription concealed identifier, SUCI)
- the authentication vector acquisition request message is used to trigger the primary authentication (Primary authentication) between the UE and the network side (core network). )process.
- the authentication vector acquisition request message carries SUPI or SUCI and is determined by the authentication vector request message received by the AUSF.
- the authentication request message carries SUPI
- the authentication vector acquisition request message carries SUPI
- the authentication request message carries SUPI
- the authentication vector acquisition request message carries SUPI
- the authentication vector acquisition request message carries SUPI
- A-KID AKMA key temporary identifier
- A-KID is also called authentication and key management-key temporary identifier. It is currently stipulated that the A-KID needs to be generated based on a routing indicator (Routing Indicator, RID), which is defined in the standard TS 23.003. Specifically, the routing identifier can be used for AUSF or UDM selection. While RID is part of SUCI, RID is not included in SUPI. When the SUPI is carried in the authentication request message, the AUSF cannot obtain the RID. As a result, the AUSF cannot generate the A-KID, resulting in the failure of the AKMA process.
- RID routing Indicator
- a first aspect of an embodiment of the present application provides a method for generating a key identifier, including: an authentication management function receives an authentication request message #1 from an access and mobility management function, and the authentication request message #1 carries a subscription hidden Identifier, the contract hidden identifier is the user hidden identifier generated based on the permanent identity identifier of the terminal device; the authentication management function sends the authentication vector acquisition request message #1 to the unified data management function, and the authentication vector acquisition request message #1 carries the The contract hides the identifier; the authentication management function receives the authentication vector acquisition response message #1 from the unified data management function, and the authentication vector acquisition response message #1 includes the authentication and key management indication information; according to the authentication and key management indication information , the authentication management function generates authentication and key management-key temporary identification #1 based on the routing identification in the contract hidden identifier; the authentication management function saves the routing identification.
- the Subscription Concealed Identifier can be understood as an encrypted form of the Permanent Identity Identifier (SUPI).
- the SUCI may include a routing identifier and an encrypted part.
- the encrypted part is the user's encrypted identity information.
- the part of SUPI other than the mobile country code (MCC) can be encrypted by the universal subscriber identity module (USIM) or the mobile equipment (ME) Calculate the encrypted part.
- USIM universal subscriber identity module
- ME mobile equipment
- the authentication request message #1 is "Nausf_UEAuthentication_Authenticate Request”.
- the authentication and key management indication information is also referred to as AKMA service indication information in this embodiment of the application, and the AKMA service indication information may be "AKMA Indication" or "AKMA ID", which is not limited in this embodiment of the application.
- the AKMA service indication information is used to indicate that the AUSF needs to generate the AKMA anchor key Kakma and the corresponding key identifier (such as authentication and key management-key temporary identity identifier) for this UE. It can also be understood as: the AKMA service indication information is used to indicate that the UE supports the AKMA service.
- the UDM sends the RID again to ensure that there is an available RID at the AUSF.
- the authentication management function AUSF saves the parameters related to the routing identifier RID (for example: SUCI, authentication and key management-key temporary identifier A-KID and/or RID).
- RID routing identifier
- the AUSF can use the RID-related parameters to generate a new A-KID to ensure the successful execution of the AKMA process.
- the method further includes: the authentication management function receives an authentication request message #2 from the access and mobility management function; in the case that the authentication request message #2 carries a permanent identity identifier, the authentication The rights management function uses the saved routing ID to generate a new authentication and key management-key temporary ID #2.
- AUSF determines the intermediate key Kausf based on the SUPI, and uses Kausf to generate A-KID#2. Based on the stored RID, the AUSF can generate a new A-KID in the case of receiving SUPI to ensure the smooth execution of the AKMA service of the UE.
- the authentication management function generates the authentication and key management-key temporary identity identifier #1 based on the routing identifier in the contract hidden identifier, including: the authentication management function is based on the authentication of the terminal device The intermediate key generated in the process generates authentication and key management-key temporary identity; the authentication management function splices the routing identity and authentication and key management-key temporary identity to obtain authentication and key management- Key Temporary ID #1.
- the format of the A-KID is "username@exmaple".
- the "username” part includes the routing identifier, and authentication and key management-terminal equipment temporary identifier (AKMA Temporary UE Identifier, A-TID).
- the "example” part includes home network identifiers such as: mobile country code (MCC) and mobile network code (MNC).
- MCC mobile country code
- MNC mobile network code
- the authentication management function saves the routing identifier, including: the authentication management function saves the authentication and key management-key temporary identity identifier #1.
- the authentication management function After the authentication management function generates the authentication and key management-key temporary identification #1, it will send the generated authentication and key management-key temporary identification #1 to other network elements (such as authentication and authentication). and Key Management Anchor Function), then delete the generated Authentication and Key Management-Key Temporary ID #1. Since the A-KID includes the routing identifier, when the authentication management function subsequently receives the SUPI-based authentication vector request message, it can still generate the corresponding A-KID for the terminal device, thus ensuring the smooth progress of the AKMA process.
- the authentication vector acquisition response message #1 also includes a routing identifier; the authentication management function generates the authentication and key management-key temporary identifier #1 based on the routing identifier in the contract hidden identifier. , including: the authentication management function generates authentication and key management-key temporary identity identifier #1 based on the routing identifier in the authentication vector acquisition response message #1.
- the AUSF can generate the authentication and key management-key temporary identity identifier #1 based on the routing identifier in the authentication vector acquisition response message #1, which improves the implementation flexibility of the solution.
- the authentication management function saves the routing identifier, including: the authentication management function saves the subscription hidden identifier.
- the implementation flexibility of the scheme is improved.
- the method further includes: the authentication management function deletes the authentication and key management-key temporary identity identifier #1.
- the authentication and key management-key temporary ID #1 can also be deleted to save the storage space of the AUSF.
- the authentication management function after the authentication management function generates the authentication and key management-key temporary identity identifier #2 based on the saved routing identifier, it further includes: the authentication management function deletes the authentication and key management-key Temporary ID #2; the authentication management function continues to store the routing ID. After the authentication and key management-key temporary identity identifier #2 is generated from the routing identifier stored in the AUSF, the authentication and key management-key temporary identity identifier #2 may also be deleted, so as to save the storage space of the AUSF. The AUSF can also continue to store routing identities to ensure the successful execution of AKMA services.
- an embodiment of the present application proposes a method for generating a key identifier, including: an authentication management function receives an authentication request message #1 from an access and mobility management function, and the authentication request message #1 carries a subscription Hidden identifier, the hidden identifier of the contract is a user hidden identifier generated based on the permanent identity of the terminal device; the authentication management function sends the authentication vector acquisition request message #1 to the unified data management function, and the authentication vector acquisition request message #1 is in the Carrying the subscription hidden identifier; the authentication management function receives the authentication vector acquisition response message #1 from the unified data management function, and the authentication vector acquisition response message #1 includes the authentication and key management indication information and the routing in the subscription hidden identifier Identification; according to the authentication and key management instruction information, the authentication management function generates the authentication and key management-key temporary identification ID #1 based on the routing identification.
- the AUSF may acquire the RID from the UDM. To ensure that when the authentication vector acquisition request message received by the AUSF carries the SUPI, the AUSF can use the RID to generate a new A-KID to ensure the successful execution of the AKMA process.
- the method further includes: the authentication management function receives an authentication request message #2 from the access and mobility management function; the authentication request message #2 includes a permanent identity; The data management function sends an authentication vector acquisition request message #2, and the authentication vector acquisition request message #2 carries a permanent identity identifier; the authentication management function receives an authentication vector acquisition response message #2 from the unified data management function, and the authentication vector The get response message #2 includes the routing ID; the authentication management function uses the routing ID to generate a new authentication and key management-key temporary ID #2.
- the AUSF can obtain the routing identifier from the UDM, which improves the implementation flexibility of the solution.
- the method further includes: the authentication management function receives an authentication request message #2 from the access and mobility management function; the authentication request message #2 includes a permanent identity; The data management function sends the authentication vector acquisition request message #2, and the authentication vector acquisition request message #2 carries the permanent identity identifier; the authentication management function acquires the routing identifier from the core network element according to the authentication and key management instruction information; The rights management function uses the routing ID to generate a new authentication and key management-key temporary ID #2.
- the AUSF can obtain routing identifiers from other core network elements, so as to ensure the successful execution of the AKMA service and improve the implementation flexibility of the solution.
- the authentication management function obtains routing identifiers from other core network elements according to the authentication and key management indication information, including: the authentication management function determines that it needs to generate Authentication and Key Management-Key Temporary ID #2; In the case that the authentication management function does not have a routing ID locally, the authentication management function obtains the routing ID from the core network element.
- the AUSF also detects whether the AUSF locally stores RID-related parameters (eg, RID, SUCI and/or A-KID). When the detection result is that there is no RID in the authentication request message #2 (or the authentication request message #2 has no RID, and the AUSF has no RID-related parameters locally), the AUSF obtains the routing identifier from the core network element.
- RID-related parameters eg, RID, SUCI and/or A-KID
- the core network element includes a unified data management function or an access and mobility management function.
- the AUSF when the AUSF does not have a routing identifier locally, the AUSF obtains the routing identifier from other core network elements, so as to ensure the successful execution of the AKMA service and improve the implementation flexibility of the solution.
- the method further includes: the authentication management function receives the authentication vector from the unified data management function
- the acquisition response message #2, the authentication vector acquisition response message #2 includes authentication and key management indication information. Only when the AUSF receives the authentication and key management indication information can the AUSF confirm that the UE supports the AKMA service. Therefore, the AUSF will acquire the routing identifier from the core network element only after this, so as to avoid waste of signaling.
- an embodiment of the present application proposes a method for generating a key identifier, including: an authentication management function receives an authentication request message #1 from an access and mobility management function, and the authentication request message #1 carries a subscription Hidden identifier, the hidden identifier of the contract is a user hidden identifier generated based on the permanent identity of the terminal device; the authentication management function sends the authentication vector acquisition request message #1 to the unified data management function, and the authentication vector acquisition request message #1 is in the Carrying the hidden identifier of the contract; the authentication management function receives the authentication vector acquisition response message #1 from the unified data management function, and the authentication vector acquisition response message #1 includes the authentication and key management instruction information; according to the authentication and key management instructions information, the authentication management function generates authentication and key management-key temporary identity ID #1 based on the routing identifier in the subscription hidden identifier; the authentication management function receives the authentication request message #2 from the access and mobility management function ; Wherein, the authentication request message #2 includes permanent identification and routing identification; The authentication management function uses
- the AUSF in the AKMA process, when the AMF determines that the UE supports the AKMA service, the AUSF can obtain the RID from the AMF. To ensure that when the authentication vector acquisition request message received by the AUSF carries the SUPI, the AUSF can use the RID to generate a new A-KID to ensure the successful execution of the AKMA process.
- the method further includes: authentication The authorization management function sends an authentication vector acquisition request message #2 to the unified data management function, wherein the authentication vector acquisition request message #2 carries a permanent identity; the authentication management function receives the authentication vector acquisition response from the unified data management function Message #2.
- the AMF may carry the RID in the authentication request message, and the AUSF obtains the RID from the authentication request message, which improves the flexibility of implementing the solution.
- the method before the authentication management function receives the authentication request message #2 from the access and mobility management function, the method further includes: the authentication management function sends a first message to the access and mobility management function.
- An authentication request response; the first authentication request response includes first indication information, where the first indication information is used to instruct the terminal device to support the authentication and key management services of the application.
- the AUSF may also notify the AMF that the UE supports the AKMA service through other indication information (the first indication information), which improves the flexibility of the implementation of the solution.
- the authentication vector acquisition response message #1 also includes a routing identifier; the authentication management function generates the authentication and key management-key temporary identifier #1 based on the routing identifier in the contract hidden identifier. , including: the authentication management function generates authentication and key management-key temporary identity identifier #1 based on the routing identifier in the authentication vector acquisition response message #1.
- the AUSF can also obtain the RID in the response message #1 through the authentication vector of the AMF, and generate the authentication and key management-key temporary identity identifier #1, which improves the implementation flexibility of the solution.
- an embodiment of the present application proposes a method for generating a key identifier, including: an authentication management function receives an authentication request message #2 from an access and mobility management function; the authentication request message #2 includes a permanent identity identification; the authentication management function sends the authentication vector acquisition request message #2 to the unified data management function, and the authentication vector acquisition request message #2 carries the permanent identity; the authentication management function receives the authentication vector acquisition from the unified data management function Response message #2, the authentication vector acquisition response message #2 includes authentication and key management indication information; the authentication management function determines that authentication and key management-key temporary identity needs to be generated according to the authentication and key management indication information; When the authentication management function does not have a routing identifier locally, the authentication management function obtains the routing identifier from the core network element; the authentication management function uses the routing identifier to generate authentication and key management-key temporary identifier #2.
- the AUSF also detects whether the AUSF locally stores RID-related parameters (eg, RID, SUCI and/or A-KID). When the detection result is that there is no RID in the authentication request message #2 (or the authentication request message #2 has no RID, and the AUSF has no RID-related parameters locally), the AUSF obtains the routing identifier from the core network element.
- RID-related parameters eg, RID, SUCI and/or A-KID
- the core network element includes a unified data management function or an access and mobility management function.
- the AUSF may acquire the RID from core network elements such as UDM or AMF. To ensure that when the authentication vector acquisition request message received by the AUSF carries the SUPI, the AUSF can use the RID to generate a new A-KID to ensure the successful execution of the AKMA process.
- an embodiment of the present application provides a communication device, including:
- the transceiver module is used to receive the authentication request message #1 from the access and mobility management function.
- the authentication request message #1 carries a subscription hidden identifier, and the subscription hidden identifier is a user hidden identifier generated based on the permanent identity of the terminal device. identification;
- the transceiver module is further configured to send an authentication vector acquisition request message #1 to the unified data management function, where the authentication vector acquisition request message #1 carries a subscription hidden identifier;
- the transceiver module is further configured to receive an authentication vector acquisition response message #1 from the unified data management function, and the authentication vector acquisition response message #1 includes authentication and key management indication information;
- a processing module configured to generate authentication and key management-key temporary identity identifier #1 based on the routing identifier in the contract hidden identifier according to the authentication and key management instruction information;
- the processing module is also used to save the routing identifier.
- the transceiver module is further configured to receive an authentication request message #2 from the access and mobility management function;
- the processing module is further configured to generate a new authentication and key management-key temporary identity identifier #2 by using the saved routing identifier when the permanent identity identifier is carried in the authentication request message #2.
- the processing module is further configured to generate authentication and key management-key temporary identity based on the intermediate key generated in the authentication process for the terminal device;
- the processing module is further used for splicing the routing identifier and the authentication and key management-key temporary identifier to obtain the authentication and key management-key temporary identifier #1.
- the processing module is further configured to save the authentication and key management-key temporary identity identifier #1.
- the authentication vector acquisition response message #1 also includes a routing identifier
- the processing module is further configured to generate authentication and key management-key temporary identity identifier #1 based on the routing identifier in the subscription hidden identifier, including:
- the processing module is further configured to generate an authentication and key management-key temporary identity identifier #1 based on the routing identifier in the authentication vector acquisition response message #1.
- the processing module is further configured to save the subscription hidden identifier.
- the processing module is further configured to delete the authentication and key management-key temporary identity identifier #1.
- the processing module is further configured to delete the authentication and key management-key temporary identity identifier #2;
- the processing module is also used to continue to save the routing identifier.
- an embodiment of the present application provides a communication device, including:
- the transceiver module is used to receive the authentication request message #1 from the access and mobility management function.
- the authentication request message #1 carries a subscription hidden identifier, and the subscription hidden identifier is a user generated based on the permanent identity of the terminal device. hidden logo;
- the transceiver module is further configured to send an authentication vector acquisition request message #1 to the unified data management function, where the authentication vector acquisition request message #1 carries a subscription hidden identifier;
- the transceiver module is also used to receive the authentication vector acquisition response message #1 from the unified data management function, and the authentication vector acquisition response message #1 includes the authentication and key management indication information and the routing identifier in the contract hidden identifier;
- the processing module is configured to generate the authentication and key management-key temporary identity identifier #1 based on the routing identifier according to the authentication and key management instruction information.
- the transceiver module is further configured to receive an authentication request message #2 from the access and mobility management function; the authentication request message #2 includes a permanent identity identifier;
- the transceiver module is further configured to send an authentication vector acquisition request message #2 to the unified data management function, and the authentication vector acquisition request message #2 carries a permanent identity identifier;
- the transceiver module is further configured to receive an authentication vector acquisition response message #2 from the unified data management function, and the authentication vector acquisition response message #2 includes a routing identifier;
- the processing module is further configured to use the routing identifier to generate a new authentication and key management-key temporary identifier #2.
- the transceiver module is further configured to receive an authentication request message #2 from the access and mobility management function; the authentication request message #2 includes a permanent identity identifier;
- the transceiver module is further configured to send an authentication vector acquisition request message #2 to the unified data management function, and the authentication vector acquisition request message #2 carries a permanent identity identifier;
- the transceiver module is also used to obtain the routing identifier from the core network element according to the authentication and key management instruction information;
- the processing module is further configured to use the routing identifier to generate a new authentication and key management-key temporary identifier #2.
- the processing module is further configured to determine, according to the authentication and key management instruction information, that authentication and key management-key temporary identity identifier #2 needs to be generated;
- the transceiver module is further configured to obtain the routing identifier from the core network element when the authentication management function does not have the routing identifier locally.
- the core network element includes a unified data management function or an access and mobility management function.
- the transceiver module is further configured to receive an authentication vector acquisition response message #2 from the unified data management function, where the authentication vector acquisition response message #2 includes authentication and key management indication information.
- an embodiment of the present application provides a communication device, including:
- the transceiver module is used to receive the authentication request message #1 from the access and mobility management function.
- the authentication request message #1 carries a subscription hidden identifier, and the subscription hidden identifier is a user generated based on the permanent identity of the terminal device. hidden logo;
- the transceiver module is further configured to send an authentication vector acquisition request message #1 to the unified data management function, where the authentication vector acquisition request message #1 carries a subscription hidden identifier;
- the transceiver module is further configured to receive an authentication vector acquisition response message #1 from the unified data management function, and the authentication vector acquisition response message #1 includes authentication and key management indication information;
- a processing module configured to generate authentication and key management-key temporary identity identifier #1 based on the routing identifier in the contract hidden identifier according to the authentication and key management instruction information;
- the transceiver module is also used to receive an authentication request message #2 from the access and mobility management function; wherein, the authentication request message #2 includes a permanent identity identifier and a routing identifier;
- the processing module is further configured to generate a new authentication and key management-key temporary identity identity #2 using the routing identity received from the access and mobility management function.
- the transceiver module is further configured to send an authentication vector acquisition request message #2 to the unified data management function, wherein the authentication vector acquisition request message #2 carries a permanent identity identifier;
- the transceiver module is further configured to receive the authentication vector acquisition response message #2 from the unified data management function.
- the transceiver module is further configured to send a first authentication request response to the access and mobility management function; the first authentication request response includes first indication information, and the first indication information is used to indicate
- the terminal device supports application authentication and key management services.
- the processing module is further configured to generate an authentication and key management-key temporary identity identifier #1 based on the routing identifier in the authentication vector acquisition response message #1.
- an embodiment of the present application provides a communication device, including:
- a transceiver module for receiving an authentication request message #2 from the access and mobility management function; the authentication request message #2 includes a permanent identity identifier;
- the transceiver module is further configured to send an authentication vector acquisition request message #2 to the unified data management function, and the authentication vector acquisition request message #2 carries a permanent identity identifier;
- the transceiver module is also used to receive the authentication vector acquisition response message #2 from the unified data management function, and the authentication vector acquisition response message #2 includes authentication and key management indication information;
- the processing module is also used to determine the need to generate the authentication and key management-key temporary identity according to the authentication and key management instruction information;
- the transceiver module is also used to obtain the routing identifier from the core network element when the authentication management function does not have the routing identifier locally;
- the processing module is further configured to use the routing identifier to generate authentication and key management-key temporary identifier #2.
- the core network element includes a unified data management function or an access and mobility management function.
- a ninth aspect of an embodiment of the present application provides a communication device, where the communication device includes: a processor, a memory, and a transceiver connected to the processor.
- a computer program or computer instruction is stored in the memory, and the processor is further configured to invoke and execute the computer program or computer instruction stored in the memory, so that the processor implements any one of the first to fourth aspects or the first to fourth aspects. Any implementation of any of the fourth aspects.
- the processor is configured to control the transceiver to implement any one of the first to fourth aspects or any one of the first to fourth aspects.
- a tenth aspect of the embodiments of the present application provides a computer program product including computer instructions, characterized in that, when it runs on a computer, the computer is made to execute any one of the first to fourth aspects or the first aspect An implementation of any of the to fourth aspects.
- An eleventh aspect of the embodiments of the present application provides a computer-readable storage medium, including computer instructions, when the computer instructions are executed on a computer, causing the computer to execute any one of the first to fourth aspects or the first aspect An implementation of any of the to fourth aspects.
- a twelfth aspect of an embodiment of the present application provides a communication apparatus, where the communication apparatus includes entities such as network equipment, terminal equipment, or chips, and the communication apparatus includes a processor for invoking a computer program or computer instruction in a memory, so that the processor executes Any one of the above-mentioned first to fourth aspects or any one of the first to fourth aspects is implemented.
- the processor is coupled to the memory through an interface.
- a thirteenth aspect of an embodiment of the present application provides a communication system, where the communication system includes the communication device of the fifth aspect, the communication device of the sixth aspect, the communication device of the seventh aspect, and/or the communication device of the first aspect.
- a fourteenth aspect of the embodiments of the present application further provides a processor for executing the foregoing various methods.
- the process of sending and receiving the above-mentioned information in the above-mentioned methods can be understood as the process of outputting the above-mentioned information by the processor and the process of receiving the above-mentioned information input by the processor.
- the processor When outputting the above-mentioned information, the processor outputs the above-mentioned information to the transceiver for transmission by the transceiver. After the above-mentioned information is output by the processor, other processing may be required before reaching the transceiver.
- the transceiver receives the above-mentioned information and inputs it into the processor. Furthermore, after the transceiver receives the above-mentioned information, the above-mentioned information may need to perform other processing before being input to the processor.
- receiving the authentication request message #1 from the AMF mentioned in the foregoing method can be understood as the processor inputting the authentication request message #1.
- sending the authentication vector acquisition request message #1 may be understood as the processor outputting the authentication vector acquisition request message #1.
- the above-mentioned processor may be a processor specially used to execute these methods, or may be a processor that executes computer instructions in a memory to execute these methods, such as a general-purpose processor.
- the above-mentioned memory can be a non-transitory (non-transitory) memory, such as a read-only memory (read only memory, ROM), which can be integrated with the processor on the same chip, or can be set on different chips respectively.
- ROM read-only memory
- a fifteenth aspect of an embodiment of the present application provides a chip system, where the chip system includes a processor and an interface, where the interface is used to acquire a program or an instruction, and the processor is used to call the program or instruction to implement or support a network
- the device implements the functions involved in the first, second, third and/or fourth aspects, eg, determining or processing at least one of the data and information involved in the above methods.
- the chip system further includes a memory for storing necessary program instructions and data of the network device.
- the chip system may be composed of chips, or may include chips and other discrete devices.
- 1a is a schematic diagram of a network architecture of a communication system
- FIG. 2 is a schematic diagram of a hardware structure of a communication device in an embodiment of the present application.
- FIG. 3 is a schematic diagram of an access flow of a UE through forwarding
- FIG. 4 is a schematic diagram of an embodiment of a method for generating a key identifier proposed by an embodiment of the present application
- FIG. 5 is a schematic diagram of an embodiment of another method for generating a key identifier in an embodiment of the present application
- FIG. 6 is a schematic diagram of an embodiment of another method for generating a key identifier in an embodiment of the present application
- FIG. 7 is a schematic diagram of an embodiment of a method for generating a key identifier in an embodiment of the present application.
- FIG. 8 is a schematic diagram of an embodiment of another method for generating a key identifier in an embodiment of the present application.
- FIG. 9 is a schematic diagram of an embodiment of a communication device in an embodiment of the present application.
- FIG. 10 is a schematic diagram of an embodiment of a communication device in an embodiment of the present application.
- FIG. 11 is a schematic diagram of an embodiment of a communication device in an embodiment of the present application.
- FIG. 12 is a schematic diagram of an embodiment of a communication device in an embodiment of the present application.
- At least one item (a) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c may be single or multiple .
- WCDMA Wideband Code Division Multiple Access
- GPRS general packet radio service
- LTE Long Term Evolution
- FDD frequency division duplex
- TDD LTE time division duplex
- UMTS universal mobile telecommunication system
- WiMAX world wide interoperability for microwave access
- the part of various communication systems that is operated by an operator may be referred to as an operator network.
- the operator network also known as the public land mobile network (PLMN) network, is a network established and operated by the government or government-approved operators for the purpose of providing land mobile communication services to the public.
- a mobile network operator (MNO) is a public network that provides users with mobile broadband access services.
- the operator network or PLMN network described in the embodiments of this application may be a network that meets the requirements of the 3rd generation partnership project (3rd generation partnership project, 3GPP) standard, which is referred to as a 3GPP network for short.
- 3rd generation partnership project 3rd generation partnership project
- 3GPP networks are operated by operators, including but not limited to fifth-generation (5th-generation, 5G) networks (referred to as 5G networks), fourth-generation (4th-generation, 4G) networks (referred to as 4G networks) Or the third-generation mobile communication technology (3rd-generation, 3G) network (referred to as 3G network). Also includes future 6G networks.
- 5G networks fifth-generation (5th-generation, 5G) networks
- 4G networks fourth-generation, 4G networks
- 3G network third-generation mobile communication technology
- 3G network third-generation mobile communication technology
- 3G network third-generation mobile communication technology
- FIG. 1a is a schematic diagram of a network architecture of a communication system.
- the network architecture may include: a terminal device (also referred to as a user equipment part, an operator network part and a data network (DN) part) .
- DN data network
- the terminal equipment part includes a terminal equipment 110, and the terminal equipment 110 may also be referred to as user equipment (user equipment, UE).
- the terminal device 110 involved in the embodiments of the present application can communicate with a device in the (radio) access network ((R)AN) 140 through the access network device in the (R)AN) 140 . or multiple core networks (core networks, CN) to communicate.
- Terminal equipment 110 may also be referred to as an access terminal, terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless network device, user agent or user device, and the like.
- the terminal device 110 can be deployed on land, including indoor or outdoor, hand-held or vehicle-mounted; can also be deployed on water (such as ships, etc.); and can also be deployed in the air (such as planes, balloons, satellites, etc.).
- the terminal device 110 may be a cellular phone (cellular phone), a cordless phone, a session initiation protocol (SIP) phone, a smart phone (smart phone), a mobile phone (mobile phone), a wireless local loop (WLL) ) station, a personal digital assistant (PDA), which can be a handheld device with wireless communication capabilities, a computing device or other device connected to a wireless modem, an in-vehicle device, a wearable device, a drone device, or the Internet of Things,
- 5G fifth generation
- PLMN public land mobile network
- the terminal, etc., where the relay user equipment may be, for example, a 5G residential gateway (RG).
- the terminal device 110 may be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control (industrial control), a wireless terminal in self driving, remote Wireless terminal in medical (remote medical), wireless terminal in smart grid (smart grid), wireless terminal in transportation safety, wireless terminal in smart city, wireless terminal in smart home (smart home) wireless terminals, etc.
- This embodiment of the present application does not limit this.
- the terminal device 110 includes an unmanned aerial vehicle and an unmanned aerial vehicle remote controller as an example for description.
- drones involved in the embodiments of the present application may also include: a vehicle that can travel autonomously, or a vehicle that travels based on the control instructions of a remote controller; a ship that can travel autonomously , or ships sailing based on the control commands of the remote control.
- the operator network may include unified data management (UDM) 134, authentication server function (AUSF) 136, access and mobility management function (AMF) 137, session management Function (session management function, SMF) 138, user plane function (user plane function, UPF) 139 and (R)AN 140 and so on.
- UDM unified data management
- AUSF authentication server function
- AMF access and mobility management function
- SMF session management Function
- user plane function user plane function
- UPF user plane function
- the data network DN 120 which may also be referred to as a protocol data network (PDN), is usually a network outside the operator's network, such as a third-party network.
- the operator network can access multiple data networks DN 120, and multiple services can be deployed on the data network DN 120, which can provide services such as data and/or voice for the terminal device 110.
- the data network DN 120 can be a private network of a smart factory, the sensors installed in the workshop of the smart factory can be terminal devices 110, and the control server of the sensor is deployed in the data network DN 120, and the control server can provide services for the sensor.
- the sensor can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server based on the instructions.
- the data network DN 120 can be an internal office network of a company, and the mobile phones or computers of employees of the company can be terminal devices 110, and the mobile phones or computers of employees can access information, data resources, etc. on the internal office network of the company.
- the terminal device 110 may establish a connection with the operator's network through an interface (eg, N1, etc.) provided by the operator's network, and use services such as data and/or voice provided by the operator's network.
- the terminal device 110 can also access the data network DN 120 through the operator network, and use the operator services deployed on the data network DN 120, and/or services provided by third parties.
- the above-mentioned third party may be a service provider other than the operator network and the terminal device 110 , and may provide other data and/or voice services for the terminal device 110 .
- the specific expression form of the above third party can be specifically determined based on the actual application scenario, which is not limited here.
- the (R)AN 140 can be regarded as a sub-network of the operator's network, and is an implementation system between the service node and the terminal device 110 in the operator's network.
- the terminal device 110 To access the operator network, the terminal device 110 first passes through the (R)AN 140, and then can be connected to the service node of the operator network through the (R)AN 140.
- the access network device (RAN device) in this embodiment of the application is a device that provides wireless communication functions for the terminal device 110, and may also be referred to as a network device.
- the RAN device includes but is not limited to: next-generation base stations in the 5G system Node (next generation node base station, gNB), evolved node B (evolved node B, eNB) in long term evolution (long term evolution, LTE), radio network controller (radio network controller, RNC), node B (node B) B, NB), base station controller (BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), base band unit (base band unit) , BBU), transmission point (transmitting and receiving point, TRP), transmitting point (transmitting point, TP), small base station equipment (pico), mobile switching center, or network equipment in future networks, etc.
- next-generation base stations in the 5G system Node node base station, gNB
- evolved node B evolved node B
- eNB evolved node B
- long term evolution long term evolution, LTE
- radio network controller radio
- the names of devices with access network device functions may be different.
- the above-mentioned apparatuses for providing wireless communication functions for the terminal device 110 are collectively referred to as access network devices or simply referred to as RAN or AN. It should be understood that the specific type of the access network device is not limited herein.
- the access and mobility management function AMF (also referred to as AMF network element, AMF network function or AMF network function entity) 137 is a control plane network function provided by the operator's network, and is responsible for the connection of the terminal device 110 to the operator's network. Access control and mobility management, including functions such as mobility status management, assignment of user temporary identities, authentication and authorization of users.
- the session management function SMF (also referred to as SMF network element, SMF network function or SMF network function entity) 138 is a control plane network function provided by the operator network, responsible for managing the protocol data unit (PDU) of the terminal device 110 ) session.
- the PDU session is a channel for transmitting PDUs, and the terminal device needs to transfer PDUs to and from the data network DN 120 through the PDU session.
- PDU sessions are established, maintained and deleted by the SMF network function 138.
- SMF network functions 138 include session management (eg session establishment, modification and release, including tunnel maintenance between user plane functions UPF 139 and (R)AN 140), selection and control of UPF network functions 139, service and session continuity ( Service and session continuity, SSC) mode selection, roaming and other session-related functions.
- session management eg session establishment, modification and release, including tunnel maintenance between user plane functions UPF 139 and (R)AN 140
- selection and control of UPF network functions 139 selection and control of UPF network functions 139
- service and session continuity Service and session continuity, SSC) mode selection, roaming and other session-related functions.
- the user plane function UPF (may also be referred to as UPF network element, UPF network function or UPF network function entity) 139 is a gateway provided by the operator, and is a gateway for the operator network to communicate with the data network DN 120.
- the UPF network function 139 includes user plane-related functions such as data packet routing and transmission, data packet detection, service usage reporting, quality of service (QoS) processing, legal interception, uplink data packet detection, and downlink data packet storage.
- QoS quality of service
- the unified data management network element UDM (also referred to as UDM network element, UDM network function or UDM network function entity) 134 is a control plane function provided by the operator, and is responsible for storing the permanent identity (subscriber permanent identity) of the subscriber in the operator's network.
- identifier, SUPI the permanent identity (subscriber permanent identity) of the subscriber in the operator's network.
- SUPI the publicly used subscription identifier (generic public subscription identifier, GPSI) of the contracting user, credential (credential) and other information.
- the SUPI will be encrypted first in the transmission process, and the encrypted SUPI is called a hidden user subscription identifier (SUCI).
- This information stored by UDM 134 can be used for authentication and authorization of terminal device 110 to access the operator's network.
- the subscribers of the above-mentioned operator network may specifically be users who use the services provided by the operator network, such as users using "China Telecom" mobile phone SIM cards, or users using "China Mobile” mobile phone SIM cards, etc.
- the above-mentioned credential of the signing user may be: a long-term key stored in the mobile phone core card or a small file stored with information related to the encryption of the mobile phone core card, which is used for authentication and/or authorization.
- permanent identifiers, credentials, security contexts, authentication data (cookies), and tokens are equivalent to verification/authentication, and authorization-related information are not differentiated and limited in the embodiments of the present application for convenience of description.
- the authentication management function (authentication server function, AUSF) (also referred to as AUSF network element, AUSF network function or AUSF network function entity) 136 is a control plane function provided by the operator, usually used for main authentication, that is, the terminal device 110 Authentication between the (subscriber) and the operator network.
- AUSF authentication server function
- AUSF network element also referred to as AUSF network function or AUSF network function entity
- AUSF network element also referred to as AUSF network element, AUSF network function or AUSF network function entity
- AUSF network function entity is a control plane function provided by the operator, usually used for main authentication, that is, the terminal device 110 Authentication between the (subscriber) and the operator network.
- the AUSF 136 After the AUSF 136 receives the authentication request initiated by the subscribed user, it can authenticate and/or authorize the subscribed user through the authentication information and/or authorization information stored in the UDM network function 134, or generate the authentication and/or
- an AKMA Anchor Key is generated for the Authentication and Key Management for Application (AKMA) Anchor Function, AAnF) 130
- the key Kakma this key management key is also called the AKMA root key
- Kaf the key management key
- AF application function
- the Network Exposure Function (NEF) 131 acts as an intermediate network element for the external application function (application Function, AF) 135 and the authentication and key management for Application (AKMA) anchor function within the core network.
- Application Function application Function
- AKMA authentication and key management for Application
- the Network Repository Function (NRF) 132 is used for network function (Network Function, NF) registration, management, or state detection, and realizes the automatic management of all NFs. When each NF starts, it must register with the NRF. Only registration can provide services, and registration information includes NF type, address, or service list.
- Network Function Network Function
- PCF Policy control function
- AF 135 Quality of Service (Quality of Service, QoS) parameters
- QoS Quality of Service
- the application function AF 135 interacts with the 3rd Generation Partnership Project (3GPP) core network to provide application layer services. For example: provide data routing on the application layer and provide the ability to access the network.
- AF 135 can interact with NEF 131 and can interact with PCF 133.
- the AF135 needs to interact with the AAnF 130 to obtain the AF root key (Kaf) and the valid time of the Kaf.
- the location of AF 135 can be inside the 5G core network or outside the 5G core network. If the AF is inside the 5G core network, it can directly interact with the PCF 133. If the AF 135 is outside the 5G core network, the NEF 131 acts as an intermediate node to forward the interactive content between the AF 135 and the PCF 133. Such as forwarding through NEF.
- AKMA anchor function AAnF 130, AAnF 130 will interact with AUSF 136 to obtain the AKMA root key (Kakma), and is responsible for generating the key Kaf and the valid time of Kaf used by AF 135 for AF 135.
- Nausf, Nudm, Namf, Nsmf, Nnrf, Nnef, Naanf, Naf, N1, N2, N3, N4, and N6 are interface serial numbers. The meanings of these interface serial numbers can be found in the meanings defined in the 3GPP standard protocol, and will not be repeated here. It should be noted that, in FIG. 1a, only the terminal device 110 is used as an example for the UE, and the interface names between the various network functions in FIG. 1a are only an example. Other names may also be used, which are not specifically limited in this embodiment of the present application.
- the mobility management network function is the AMF network function 137 as an example for description. It may also be other network functions with the above-mentioned AMF network function 137 in the future communication system. Alternatively, the mobility management network function in this application may also be a mobility management network element (Mobility Management Entity, MME) in LTE, or the like. Further, the AMF network function 137 is referred to as AMF for short, and the terminal device 110 is referred to as UE, that is, the AMF described later in the embodiments of the present application can be replaced by a mobility management network function, and the UE can be replaced by a terminal device. .
- MME Mobility Management Entity
- a method for generating a key identifier provided by this application can be applied to various communication systems, for example, it can be the Internet of Things (Internet of Things, IoT), the narrowband Internet of Things (NB-IoT), Long term evolution (LTE), it can also be the fifth generation (5G) communication system, it can also be a hybrid architecture of LTE and 5G, it can also be a 5G new radio (NR) system and it will appear in the future communication development. new communication systems, etc.
- the 5G communication system of the present application may include at least one of a non-standalone (NSA) 5G communication system and an independent (standalone, SA) 5G communication system.
- the communication system may also be a public land mobile network (PLMN) network, a device-to-device (D2D) network, a machine-to-machine (M2M) network, or other networks.
- PLMN public land mobile network
- D2D device-to-device
- M2M machine-to-machine
- embodiments of the present application may also be applicable to other future-oriented communication technologies, such as 6G and the like.
- the network architecture and service scenarios described in this application are for the purpose of illustrating the technical solutions of this application more clearly, and do not constitute a limitation on the technical solutions provided by this application.
- the appearance of each network function involved in this application may be changed, and the technical solutions provided in this application are also applicable to similar technical problems.
- FIG. 2 is a schematic diagram of a hardware structure of a communication device according to an embodiment of the present application.
- the communication apparatus may be a possible implementation manner of the network device or the terminal device in the embodiment of the present application.
- the communication apparatus includes at least a processor 204 , a memory 203 , and a transceiver 202 , and the memory 203 is further configured to store instructions 2031 and data 2032 .
- the communication device may further include an antenna 206 , an I/O (input/output, Input/Output) interface 210 and a bus 212 .
- the transceiver 202 further includes a transmitter 2021 and a receiver 2022.
- the processor 204 , the transceiver 202 , the memory 203 and the I/O interface 210 are communicatively connected to each other through the bus 212 , and the antenna 206 is connected to the transceiver 202 .
- the processor 204 can be a general-purpose processor, such as, but not limited to, a central processing unit (Central Processing Unit, CPU), or can be a special-purpose processor, such as, but not limited to, a digital signal processor (Digital Signal Processor, DSP), application Application Specific Integrated Circuit (ASIC) and Field Programmable Gate Array (FPGA), etc.
- the processor 204 may also be a neural network processing unit (NPU).
- the processor 204 may also be a combination of multiple processors.
- the processor 204 may be configured to execute the relevant steps of the method for generating the key identifier in the subsequent method embodiments.
- the processor 204 may be a processor specially designed to perform the above steps and/or operations, or may be a processor that performs the above steps and/or operations by reading and executing the instructions 2031 stored in the memory 203, the processor 204 Data 2032 may be required in performing the steps and/or operations described above.
- the transceiver 202 includes a transmitter 2021 and a receiver 2022 .
- the transmitter 2021 is used to transmit signals through the antenna 206 .
- the receiver 2022 is used to receive signals through at least one of the antennas 206 .
- the transmitter 2021 may be specifically configured to be executed by at least one antenna among the antennas 206.
- the method for generating the key identifier in the subsequent method embodiments is applied to a network device or terminal device, the operation performed by the receiving module or the sending module in the network device or terminal device.
- the transceiver 202 is configured to support the communication device to perform the aforementioned receiving function and sending function.
- a processor with processing capabilities is considered processor 204 .
- the receiver 2022 may also be called an input port, a receiving circuit, and the like, and the transmitter 2021 may be called a transmitter or a transmitting circuit, and the like.
- the processor 204 may be configured to execute the instructions stored in the memory 203 to control the transceiver 202 to receive messages and/or send messages, so as to complete the function of the communication device in the method embodiment of the present application.
- the function of the transceiver 202 may be implemented by a transceiver circuit or a dedicated chip for transceiver.
- receiving a message by the transceiver 202 may be understood as an input message by the transceiver 202
- sending a message by the transceiver 202 may be understood as an output message by the transceiver 202 .
- the memory 203 may be various types of storage media, such as random access memory (Random Access Memory, RAM), read only memory (Read Only Memory, ROM), non-volatile RAM (Non-Volatile RAM, NVRAM), and Programmable ROM (Programmable ROM, PROM), Erasable PROM (Erasable PROM, EPROM), Electrically Erasable PROM (Electrically Erasable PROM, EEPROM), Flash memory, optical memory and registers, etc.
- the memory 203 is specifically used to store the instructions 2031 and the data 2032, and the processor 204 can perform the steps and/or operations described in the method embodiments of the present application by reading and executing the instructions 2031 stored in the memory 203. Data 2032 may be required during the operations and/or steps of a method embodiment.
- the communication apparatus may further include an I/O interface 210, and the I/O interface 210 is used for receiving instructions and/or data from peripheral devices, and outputting instructions and/or data to peripheral devices.
- I/O interface 210 is used for receiving instructions and/or data from peripheral devices, and outputting instructions and/or data to peripheral devices.
- FIG. 3 is a schematic diagram of an access flow of a UE through forwarding. Take Figure 3 as an example to illustrate the AKMA process, specifically:
- a primary authentication (Primary authentication) process is performed between the UE and the core network.
- the main authentication process needs to use an authentication vector (authentication vector, AV), and the authentication vector is used to transfer the verification parameters of the main authentication process in the main authentication process.
- the AUSF obtains the authentication vector.
- the main authentication process is also called an authentication process, which is not limited here.
- the AUSF sends an authentication vector acquisition request message to the UDM.
- the AUSF sends an authentication vector acquisition request message to the UDM, where the authentication vector acquisition request message is, for example, "Numd_UEAuthentication Get Request".
- the authentication vector acquisition request message is used to request an authentication vector from the UDM.
- the authentication vector acquisition request message carries SUPI or SUCI. Specifically, when the message sent by the AMF to the AUSF carries SUPI, the authentication vector acquisition request message carries SUPI; when the message sent by the AMF to the AUSF carries SUCI, the authentication vector acquisition request message carries SUCI.
- SUCI can be understood as an encrypted form of SUPI.
- the specific generation method of SUCI can refer to 3GPP standard TS 33.501.
- the part of SUPI other than the mobile country code (MCC) can be encrypted and calculated by the universal subscriber identity module (USIM) or mobile equipment (ME) to obtain the SUCI encryption part.
- MCC mobile country code
- USIM universal subscriber identity module
- ME mobile equipment
- SUCI also includes RID, MCC, MNC, etc.
- the AUSF receives the authentication vector acquisition response message sent by the UDM.
- step 303 after the UDM receives the authentication vector acquisition request message in step 302, the UDM determines the corresponding authentication vector.
- the UDM sends an authentication vector acquisition response message to the AUSF, where the authentication vector acquisition response message carries the authentication vector.
- the authentication vector acquisition response message is, for example: "Num_UEAuthentication_Get Response".
- the UDM determines whether the UE corresponding to the main authentication process supports the AKMA service based on the user subscription data corresponding to the SUPI.
- the authentication vector acquisition response message carries AKMA service indication information, and the AKMA service indication information may be "AKMA Indication" or "AKMA ID", which is not limited in the embodiments of this application.
- the AKMA service indication information is used to indicate that the AUSF needs to generate the AKMA anchor key Kakma for this UE. It can also be understood as: the AKMA service indication information is used to indicate that the UE supports the AKMA service.
- the authentication vector acquisition request message does not carry the AKMA service indication information.
- AKMA indication and AKMA ID can use the same cell or different cells, which are not limited here.
- the UE generates an AKMA anchor key Kakma based on the AUSF root key.
- step 304a after the UE's primary authentication process is successfully completed, the UE generates an AKMA anchor key (Kakma) based on the same root key (Kausf) used by the AUSF.
- the UE generates an AKMA anchor key (Kakma) based on the same root key (Kausf) used by the AUSF.
- the UE generates an authentication and key management-key temporary identity identifier A-KID.
- step 304b after the main authentication process of the UE is successfully completed, before the UE initiates the AKMA service, the UE generates authentication and key management-key temporary identity (AKMA) based on the same root key (Kausf) used by the AUSF. -Key Identifier, A-KID).
- the A-KID is used to identify the UE's AKMA anchor key Kakma.
- the UE before the UE initiates the AKMA service, the UE generates an A-KID based on the same root key (Kausf) used by the AUSF. Specifically, the UE generates the key management-key temporary identifier (AKMA Temporary UE Identifier, A-TID) part in the A-KID based on the same root key (Kausf) used by the AUSF.
- AKMA Temporary UE Identifier, A-TID key management-key temporary identifier
- A-KID is generated based on the RID.
- A-KID format is "username@exmaple”.
- the "username” part includes the routing identifier, and the Authentication and Key Management-Key Temporary Identifier (AKMA Temporary UE Identifier, A-TID).
- the "example” part includes home network identifiers such as: mobile country code (MCC) and mobile network code (MNC).
- MCC mobile country code
- MNC mobile network code
- A-TID is a temporary identification based on Kausf.
- step 304a and step 304b is not limited.
- the AUSF generates the AKMA anchor key Kakma based on the AUSF root key.
- Step 305a is similar to the aforementioned step 304a, and will not be repeated here.
- the difference from 304a is that after the AUSF receives the authentication vector acquisition response message, if the message carries the AKMA service indication information, the AUSF uses the Kausf acquired by the AUSF to generate Kakma and A-KID. If the authentication vector acquisition response message does not carry the AKMA service indication information, the AUSF may not generate Kakma and A-KID.
- the AUSF generates an authentication and key management-key temporary identity identifier A-KID.
- step 305b when in step 303, the authentication vector acquisition response message sent by the UDM carries the AKMA identification information, the AUSF determines that an A-KID needs to be generated based on the AKMA identification information.
- step 302 when the AMF provides the SUCI to the AUSF, in step 305b, the AUSF generates an A-KID based on the RID in the SUCI.
- the AUSF sends an AKMA anchor key registration request message to the AAnF.
- step 306 after the AUSF selects an AAnF, the AUSF sends an AKMA anchor key registration request message to the AAnF.
- the AKMA anchor key registration request message is for example: "Naanf_AKMA_AnchorKey_Register Request”. Specifically, the AKMA anchor key registration request message carries SUPI, A-KID and Kakma.
- the AUSF receives the AKMA anchor key registration response message sent by the AAnF.
- the AAnF sends an AKMA anchor key registration response message to the AUSF based on the AKMA anchor key registration request message in step 306.
- the AKMA anchor key registration response message is for example: "Naanf_AKMA_AnchorKey_Register Response”.
- AUSF deletes Kakma and A-KID.
- step 308 after the AUSF receives the AKMA anchor key registration response message sent from the AAnF, the AUSF deletes the Kakma and the A-KID.
- RIDs are included in SUCI.
- the current standard specifies that RID is used for AMF to look up AUSF and AUSF to look up UDM.
- the RID is used to generate the A-KID.
- RID is also used to select AAnF.
- the RID is stored in the USIM.
- the 5G UE uses the 5G USIM, the 5G UE obtains the RID to be used from the 5G USIM.
- the value of the RID can be a non-default value or a default value.
- the RID is included in the context of the UE. It can be understood that after the AMF obtains the RID from the SUCI, the RID is stored in the AMF.
- the AMF provides the AUSF with SUPI in step 302
- the SUPI does not include the RID.
- the current standard stipulates that the AUSF does not store the RID of the UE. Therefore, under the premise that the AMF provides the AUSF with SUPI in step 302, the AUSF cannot generate an A-KID in step 305b (RID is a necessary parameter for generating A-KID). Hence the failure of the AKMA process.
- the AMF may decide whether to authenticate the UE based on a local policy.
- the AMF decides to authenticate the UE, that is, initiates the main authentication process
- the authentication request message sent by the AMF to the AUSF for triggering the authentication of the UE carries the SUPI (step 302).
- the AUSF cannot obtain the RID.
- the AUSF cannot generate an A-KID.
- the request message for UE authentication is, for example, a "Nausf_UEAuthentication_Authenticate Request" message.
- an embodiment of the present application proposes a method for generating a key identifier, so as to ensure that the AUSF can obtain the RID, thereby ensuring that the AUSF generates an A-KID, and thus ensuring the smooth execution of the AKMA service of the UE.
- the AUSF stores the RID, which comes from AMF or UDM. Specifically, please refer to the embodiment shown in FIG. 4 .
- the AUSF obtains the RID from the core network element.
- the core network element includes AMF or UDM.
- the AUSF obtains the RID from the AMF. Please refer to the embodiment shown in FIG. 5 and/or the embodiment shown in FIG. 6 .
- the AUSF obtains the RID from the UDM. Please refer to the embodiment shown in FIG. 7 and/or the embodiment shown in FIG. 8 .
- RID#1 the RID carried in SUCI
- RID#2 the RID from UDM
- RID#3 the RID from AMF
- RID#3 the RID in AUSF
- the stored RID is called RID#4. It can be understood that RID#1, RID#2, RID#3, and RID#4 may have the same value, and therefore, labels may be mixed in subsequent embodiments.
- FIG. 4 is a schematic diagram of an embodiment of a method for generating a key identifier proposed by an embodiment of the present application.
- a method for generating a key identifier proposed by an embodiment of the present application includes:
- the AUSF receives an authentication request message #1 sent by the AMF, where the authentication request message #1 carries SUCI.
- the AUSF receives the authentication request message #1 sent by the AMF, and the authentication request message #1 carries the SUCI. Specifically, the authentication request message #1 is "Nausf_UEAuthentication_Authenticate Request".
- the RID carried in the SUCI is RID#1.
- the AUSF sends an authentication vector acquisition request message #1 to the UDM, where the authentication vector acquisition request message #1 carries SUCI.
- the AUSF After the AUSF receives the authentication request message #1 sent by the AMF, the AUSF sends the authentication vector acquisition request message #1 to the UDM, and the authentication vector acquisition request message #1 carries the SUCI.
- the authentication vector get request message #1 may be: "Nudm_UE_Authentication_Get_Request”.
- the AUSF stores the SUCI, or stores the RID#1 in the SUCI.
- the AUSF can store the SUCI to the AUSF local, and the AUSF can also store the RID#1 in the SUCI to the AUSF local, which is not limited here.
- Step 403 is an optional step.
- Step 403 may occur before step 402, that is, after the AUSF receives the authentication request message #1 carrying the SUCI, the AUSF first stores the SUCI, or stores the RID#1 in the SUCI, and then executes step 402.
- this step is temporary storage, and the temporary storage is for when the AUSF receives the authentication vector response message, if the AUSF determines that the UE supports the AKMA service, it can use the RID#1 in the SUCI to generate the A-KID# 1. If the AUSF determines that the UE does not support the AKMA service (that is, the AKMA indication has not been received), the AUSF may delete SUCI or delete RID#4 in the subsequent procedure.
- the AUSF After acquiring the RID#1 in the SUCI, the AUSF stores the RID#1 locally, and the local RID is called RID#4 at this time.
- the AUSF receives the authentication vector acquisition response message #1 sent by the UDM.
- the authentication vector acquisition response message #1 carries RID#2.
- the UDM receives the authentication vector acquisition request message #1 sent by the AUSF.
- the AUSF receives the authentication vector acquisition response message #1 from the UDM, the AUSF performs an authentication operation on the UE (the UE corresponding to the authentication request message #1).
- the authentication operation mode is to carry out the main authentication process, and the main authentication process can refer to the relevant description in Section 6 of the standard TS 33.501.
- the authentication vector acquisition response message #1 also carries an authentication vector (authentication vector, AV).
- the authentication vector acquisition response message #1 also carries authentication and key management indication information AKMA indication.
- the authentication vector acquisition response message #1 is "Nudm_UE_Authentication_Get_Response".
- the AUSF sends an authentication request response (authentication success) to the AMF.
- the authentication vector acquisition response message #1 may also carry RID#1, and at this time, the authentication vector acquisition response message #1 also carries AKMA INDICATION and AV. Further, after determining that the UE supports the AKMA service, the UDM determines RID#2 , and carries the RID#2 in the authentication vector acquisition response message #1. The UDM sends RID#2 again to ensure that there is an available RID at the AUSF. For example, if the AUSF does not execute step 403, the AUSF can only obtain RID#2 through step 404, and use RID#2 to generate A-KID#1.
- the AUSF After the AUSF authenticates the UE successfully, the AUSF sends a first authentication request response to the AMF.
- the first authentication request response is a "Nausf_UEAuthentication_Authenticate Response" message, and the message carries an extensible authentication protocol-success (extensible authentication protocol-success, EAP-success) message or carries indication information that informs the AMF whether the authentication to the UE is successful.
- extensible authentication protocol-success extensible authentication protocol-success, EAP-success
- the AUSF generates A-KID#1 based on the RID.
- the AUSF After the AUSF receives the authentication vector acquisition response message #1 from the UDM, the AUSF determines that the UE supports the AKMA service based on the AKMA service indication information, and then the AUSF generates the authentication and key management-key temporary identity identifier A-KID#1.
- the AUSF when step 403 is performed, the AUSF generates A-KID#1 based on the RID#1 in the locally stored SUCI, or the AUSF based on the locally stored RID#4. It can also be understood that the AUSF generates the A-KID#1 based on the RID#1 in the SUCI carried in the authentication request message #1 in step 401 .
- step 403 when step 403 is not performed, when the optional method of sending RID#2 in step 404 is performed, the AUSF generates A-KID#1 based on RID#2 sent by UDM.
- the AUSF If the AUSF does not receive the AKMA indication in step 404, and if step 403 is performed, the AUSF deletes the locally stored SUCI or RID#1 in the SUCI.
- the AUSF can send the A-KID#1, SUPI and Kakma to the AAnF. Specifically, it can be sent to AAnF through "Naanf_AnchorKey_Register Request". After receiving the message, AAnF replies "Naanf_AKMA_Register Response" to AUSF.
- AUSF generates Kakma based on the SUCI. To distinguish, the Kakma generated here is called Kakma-1.
- the AUSF stores the RID.
- the AUSF determines to store RID#1. Specifically, after the AUSF receives the AKMA indication of the UE and indicates that the AUSF needs to generate Kakma and A-KID, the AUSF determines that the UE supports the AKMA service.
- the RID stored by the AUSF in step 407 may be RID#1 or RID#2 according to the source of the RID.
- step 403 the AUSF continues to store the SUCI after judging that the UE supports the AKMA service, or stores the RID#1 in the SUCI.
- step 403 when the optional method of sending RID#2 in step 404 is executed, after the AUSF determines that the UE supports the AKMA service, the AUSF stores the RID#2.
- step 407 there are various optional implementation manners for the AUSF to store the parameters related to RID#1, which will be described separately below.
- the parameters related to RID#1 include but are not limited to: RID#1, SUCI, and/or A-KID#1.
- AUSF stores RID#1 in SUCI and the association relationship between RID#1 and SUPI.
- RID#1, SUPI is stored.
- the association relationship between RID#1 and SUPI is stored for the purpose of determining RID#1 based on SUPI when the AUSF receives SUPI.
- the AUSF stores SUCI, that is, the AUSF does not store RID#1 alone. Further, AUSF stores SUCI and the association between SUCI and SUPI.
- Scheme 3 AUSF stores RID#1, SUCI, and the association relationship among RID#1, SUCI, and SUPI.
- step 407 and step 406 is not limited here.
- the AUSF may generate A-KID#1 first, and then store RID#1 or SUCI secondly.
- the AUSF may also store the RID#1 or store the SUCI, and then generate the A-KID#1, which is not limited here.
- the AUSF deletes RID#1 and/or SUCI after generating A-KID#1, the AUSF stores A-KID#1. Then in step 410, the AUSF generates A-KID#2 based on the A-KID#1. Specifically, the AUSF generates A-KID#2 based on RID#1 in A-KID#1. Further, the AUSF stores the association relationship between A-KID#1 and SUPI.
- the value of RID#1 is a default value
- the AUSF may not store RID#1.
- the AUSF uses the default RID#1 value to generate A-KID#2.
- step 407 does not need to be repeatedly stored. It can be understood that step 407 is a continuation of step 403, that is, if step 403 occurs, then the AUSF only needs to further determine that the UE supports the AKMA service, and only needs to further associate with SUPI when executing step 407.
- step 407 does not need to be repeatedly stored. It can be understood that step 407 is a continuation of step 404, that is, if the optional method of sending RID#1 in step 404 is executed, and after the AUSF determines that the UE supports the AKMA service, then step 407 only needs to further store RID#1 Association with SUPI.
- AUSF deletes SUCI.
- Step 408 is an optional step. Specifically, after the AUSF stores the SUCI in step 403, when the AUSF also stores RID#4 and/or A-KID#1, the AUSF may delete the SUCI.
- the AUSF may store only one of the parameters, and consider deleting other redundant parameters.
- the SUCI mentioned in this step 408 and the A-KID#1 mentioned in the preceding steps can be understood as redundant parameters relative to the RID#1.
- the AUSF cannot obtain the RID#1.
- the AUSF receives the authentication request message #2 sent by the AMF.
- the AUSF receives the authentication request message #2 sent by the AMF, and the authentication request message #2 is used to trigger the authentication operation for the UE.
- the authentication request message #2 may be "Nausf_UEAuthentication_Authenticate Request".
- step 410 is entered.
- the subsequent method is similar to steps 402-408, and details are not described here.
- step 410 is performed subsequently.
- the AUSF may send the authentication vector acquisition request message #2 "Nudm_UE_Authentication_Get_Request" to the UDM, and the authentication vector acquisition request message #2 carries the SUPI in the authentication request message #2.
- the UDM determines that the UE supports the AKMA service based on the SUPI
- the UDM replies to the authentication vector acquisition response message #2 "Nudm_UE_Authentication_Get_Response" carrying the AKMA service indication information (for example, AKMA indication).
- the AUSF After step 409, when the AUSF successfully authenticates the UE, the AUSF sends a second authentication request response to the AMF.
- the second authentication request response is for example "Nausf_UEAuthentication_Authenticate Response").
- the AUSF When the SUPI is carried in the authentication request message #2, the AUSF generates an A-KID#2.
- AUSF determines the Kausf, and uses the Kausf to generate the Kakma. To distinguish, the Kausf here is called Kausf-2, and the Kakma generated here is called Kakma-2.
- the AUSF determines the RID-related parameters based on the SUPI carried in the authentication request message #2. The AUSF then determines the RID based on the RID-related parameters, and the AUSF generates A-KID#2 based on the RID.
- the various implementations are described below:
- the AUSF when the authentication request message #2 carries the SUPI, the AUSF generates the A-KID#2 based on the RID#4. Specifically, the RID#4 comes from the local AUSF. Specifically, the AUSF determines the RID#4 associated with the SUPI based on the SUPI, and then generates the A-KID#2 based on the RID#4.
- the AUSF when the authentication request message #2 carries the SUPI, the AUSF generates the A-KID#2 based on the RID#4 in the SUCI. Specifically, the SUCI comes from the local AUSF. Specifically, the AUSF determines the SUCI associated with the SUPI based on the SUPI, and then generates an A-KID#2 based on the RID#1 in the SUCI.
- the AUSF when the SUPI is carried in the authentication request message #2, the AUSF generates the A-KID#2 based on the RID#4 in the A-KID#1. Specifically, the A-KID#1 comes from the local AUSF. Specifically, the AUSF determines the A-KID#1 associated with the SUPI based on the SUPI, and then generates the A-KID#2 based on the RID#4 in the A-KID#1.
- the AUSF when the authentication request message #2 carries SUPI, if the authentication vector acquisition response message #2 carries the RID#2, the AUSF generates the A-KID# based on the received RID#2 2.
- the AUSF when the authentication request message #2 carries SUPI, and the AUSF does not locally store any RID#4-related parameters (for example, SUCI, A-KID, and/or RID#4), Meanwhile, the AUSF does not receive the parameters related to RID#2 from the UDM, so the AUSF generates A-KID#2 by using the default value of the RID.
- the AUSF may send A-KID#2, SUPI and Kakma-2 to the AAnF. Specifically, it can be sent to AAnF through "Naanf_AnchorKey_Register Request". After AAnF receives the message, it replies "Naanf_AKMA_Register Response" to AUSF.
- the AUSF continues to store parameters related to RID#4.
- the AUSF continues to store RID#4 or the AUSF continues to store SUCI, or A-KID#1. And remove other redundant parameters. For example, after the AUSF deletes A-KID#2, it can continue to store RID#4.
- the AUSF if the AUSF receives SUCI#2 (the SUPI#2 is inconsistent with the SUCI received in step 401), the AUSF saves RID#3, where the RID in SUPI#2 is called RID#5, Or AUSF holds SUCI#2. It can be understood that the AUSF saves the parameters related to RID#5 (for example, SUCI#2 and/or RID#5), and does not need to continue to save the parameters related to RID#4.
- the specific operation can be directly overwriting, or first deleting and then storing, or first storing and then deleting. This application does not make specific restrictions.
- A-KID#1 was previously stored by the AUSF. After generating A-KID#2, the AUSF stores A-KID#2. It can be understood that the AUSF stores A-KID#2, and does not need to continue to store A-KID#1.
- the specific operation can be directly overwriting, or first deleting and then storing, or first storing and then deleting. This application does not make specific restrictions.
- the AUSF saves RID-related parameters (for example, SUCI, A-KID, and/or RID).
- RID-related parameters for example, SUCI, A-KID, and/or RID.
- FIG. 5 is a schematic diagram of an embodiment of yet another method for generating a key identifier in an embodiment of the present application.
- a method for generating a key identifier proposed by an embodiment of the present application includes:
- the AUSF receives an authentication request message #1 sent by the AMF, where the authentication request message #1 carries SUCI.
- Step 501 is similar to the foregoing step 401, and details are not described here.
- the AUSF generates A-KID#1.
- the AUSF after the AUSF receives the authentication request message #1, the AUSF generates the A-KID #1 based on the RID #1 in the SUCI in the authentication request message #1. Before the AUSF generates the A-KID#1, after the AUSF receives the authentication request message #1, the AUSF may send the authentication vector acquisition request message #1 to the UDM, and the authentication vector acquisition request message #1 carries the SUCI.
- the authentication vector acquisition request message may be: "Nudm_UE_Authentication_Get_Request".
- the UDM After the UDM receives the authentication vector acquisition request message #1 sent by the AUSF.
- the UDM sends an authentication vector acquisition response message #1 to the AUSF, where the authentication vector acquisition response message #1 carries an authentication vector (authentication vector, AV).
- the authentication vector acquisition response message #1 when the UDM determines that the UE corresponding to the SUCI supports the AKMA service, the authentication vector acquisition response message #1 also carries the authentication and key management indication information AKMA indication.
- the authentication vector acquisition response message #1 carries RID#1.
- the AUSF after the AUSF receives the authentication vector acquisition response message #1, the AUSF generates A-KID #1 based on the RID #1 in the authentication vector acquisition response message #1.
- RID#2 is carried only when the UDM determines that the UE corresponding to the SUCI supports the AKMA service.
- the authentication vector acquisition response message #1 is "Nudm_UE_Authentication_Get_Response”.
- the AUSF After the AUSF receives the authentication vector acquisition response message #1 from the UDM, the AUSF performs an authentication operation on the UE (the UE corresponding to the authentication request message #1). When the authentication is successful, the AUSF sends a first authentication request response to the AMF.
- the first authentication request response includes first indication information (indication), where the first indication information is used to indicate that the UE supports the AKMA service.
- first indication information indication
- the first indication information and the AKMA service indication information may use the same information element, or may use different information elements, which is not limited here.
- Kakma-1 Kakma-1.
- the AUSF can send the A-KID#1, SUPI and Kakma to the AAnF. Specifically, it can be sent to AAnF through "Naanf_AnchorKey_Register Request". After receiving the message, AAnF replies "Naanf_AKMA_Register Response" to AUSF. After the AUSF receives the "Naanf_AKMA_Register Response", it generates Kakma-1 and A-KID#1.
- the AUSF can temporarily store the SUCI or RID#1 in the SUCI, wait until it is determined that there is AKMA service indication information, and after Kakma-1 and A-KID#1 are generated, delete the SUCI or SUCI. RID#1.
- the AUSF receives the authentication request message #2 sent by the AMF.
- the AUSF receives the authentication request message #2 sent by the AMF.
- the authentication request message #2 carries SUPI, and the process goes to step 504 .
- the AUSF may send the authentication vector acquisition request message #2 to the UDM, where the authentication vector acquisition request message #2 carries the SUPI.
- the authentication vector get request message #2 may be: "Nudm_UE_Authentication_Get_Request”.
- the UDM receives the authentication vector acquisition request message #2 sent by the AUSF.
- the UDM sends an authentication vector acquisition response message #2 to the AUSF, where the authentication vector acquisition response message #2 carries an authentication vector (authentication vector, AV).
- the UDM determines that the UE corresponding to the SUPI supports the AKMA service
- the authentication vector acquisition response message #2 also carries the AKMA indication.
- the authentication vector acquisition response message #2 is "Nudm_UE_Authentication_Get_Response".
- the AUSF determines that the UE supports the AKMA service.
- the AUSF determines that the UE's A-KID needs to be generated.
- the AUSF performs an authentication operation on the UE (the UE corresponding to the authentication request message #2).
- the AUSF sends an authentication request response (authentication success) to the AMF.
- the RID#3 may be carried in the authentication request message #2.
- This step is optional because in the prior art, the RID itself is optional and passed from the AMF to the AUSF through an authentication request message.
- the function of transmitting the RID in the prior art is to facilitate the AUSF to quickly find a UDM that can serve the UE through the RID.
- the authentication request message #2 if the authentication request message #2 carries the SUPI, the authentication request message #2 also carries the RID#3. This is done to ensure that the AUSF has a usable RID, so as to avoid generating an A-KID without an available RID when the AUSF determines that the UE corresponding to the SUPI supports the AKMA service.
- the AUSF sends a first request to the AMF, where the first request carries the SUPI.
- the AUSF After the AUSF receives the authentication request message #2 sent by the AMF, the AUSF detects whether the authentication request message #2 carries the RID. Optionally, the AUSF also detects whether the AUSF locally saves parameters related to RID#4 (for example, RID#4, SUCI and/or A-KID#1).
- RID#4 for example, RID#4, SUCI and/or A-KID#1.
- the AUSF sends a first request to the AMF, where the first request is used to request an RID.
- the first request carries the SUPI, and the SUPI is the SUPI carried in the authentication request message #2. Further, if neither the authentication request message #2 nor the AUSF has a local RID-related parameter, the AUSF sends a first request to the AMF, where the first request is used to request the RID.
- the first request carries indication information that an RID is required.
- the AUSF After the AUSF receives the authentication vector acquisition response message #2 sent by the UDM, after the AUSF determines that the UE supports the AKMA service, the AUSF does not receive the RID#4 in the authentication request message #2, and/or the AUSF does not locally If RID#4 is stored, the AUSF sends the first request to the AMF.
- step 504 after the AUSF receives the authentication request message #2 sent by the AMF, there are two optional implementation schemes, which are described below:
- the AUSF After each time the AUSF receives the authentication request message #2, it detects whether the authentication request message #2 carries the RID. Optionally, the AUSF also detects whether the AUSF locally saves parameters related to RID#4 (for example, RID#4, SUCI and/or A-KID#1). When the detection result is that there is no RID#3 in the authentication request message #2 (or the authentication request message #2 has no RID, and the AUSF does not have parameters related to RID#4 locally), the AUSF sends the first request to the AMF. In step 506, the AUSF does not save the RID#3 carried in the first response from the AMF. That is, each time the AUSF receives the authentication request message #2, it will detect whether the authentication request message #2 carries the RID, and if not, the AUSF sends the first request to the AMF.
- RID#4 for example, RID#4, SUCI and/or A-KID#1
- the AUSF After receiving the authentication request message #2, the AUSF detects whether the authentication request message #2 carries the RID. Optionally, the AUSF also detects whether the AUSF locally saves parameters related to RID#4 (for example, RID#4, SUCI and/or A-KID#1). When the detection result is that there is no RID#3 in the authentication request message #2 (or the authentication request message #2 has no RID, and the AUSF does not have parameters related to RID#4 locally), the AUSF sends the first request to the AMF. In step 506, the AUSF saves the RID#3 carried in the first response from the AMF.
- RID#4 for example, RID#4, SUCI and/or A-KID#1
- the AUSF sends the first request to the AMF.
- the AUSF will save the RID#3 returned by the AMF based on the first request.
- the AUSF may perform subsequent actions based on the locally stored RID #4 (stored in step 506).
- the first request is "Nudm_UE_AKMA_Get_Request".
- the AUSF After the AUSF receives the authentication request message #2 sent by the AMF, the AUSF determines whether the authentication request message #2 carries the RID. If the RID is carried, step 507 is executed.
- step 507 is executed.
- the AMF determines RID#3 based on the SUPI carried in the first request.
- the AMF After receiving the first request, the AMF determines the RID#3 corresponding to the SUPI based on the SUPI carried in the first request.
- the AMF after receiving the first request, the AMF first determines the RID#3 corresponding to the SUPI based on the SUPI carried in the first request. Next, the AMF constructs the SUCI based on the RID#3, and for the convenience of distinction, the SUCI constructed based on the RID#2 is called SUCI#3. Specifically, the AMF generates SUCI#3 in the same manner as the UE using the public key of the home network (HPLMN) and the SUPI of the UE. At this time, the AMF is required to locally store or obtain the necessary parameters for generating SUCI, such as the public key and public key identifier of the HPLMN.
- HPLMN public key of the home network
- the AMF sends a first response to the AUSF, where the first response carries RID#3.
- the AMF sends a first response to the AUSF, where the first response carries RID#3.
- the first response sent by the AMF to the AUSF carries the SUCI#3 constructed in step 505. At this time, the RID is not carried in the first response.
- the first response is "Nudm_UE_AKMA_Get_Response”.
- the AUSF generates A-KID#2 based on the RID#3.
- AUSF generates Kakma.
- Kakma-2 the Kakma generated here is called Kakma-2.
- the AUSF may send A-KID#2, SUPI and Kakma-2 to the AAnF. Specifically, it can be sent to AAnF through "Naanf_AnchorKey_Register Request". After receiving the message, AAnF replies "Naanf_AKMA_Register Response" to AUSF.
- the AUSF may delete A-KID#2.
- the AUSF may not delete the A-KID#2.
- the AUSF can delete Kakma-2.
- step 507 optionally, after the AUSF deletes A-KID#2, SUPI and/or RID#3 may be saved.
- the AUSF may acquire the RID from the AMF. To ensure that when the authentication vector acquisition request message received by the AUSF carries the SUPI, the AUSF can use the RID to generate a new A-KID to ensure the successful execution of the AKMA process.
- FIG. 6 is a schematic diagram of an embodiment of another method for generating a key identifier in an embodiment of the present application.
- a method for generating a key identifier proposed by an embodiment of the present application includes:
- the AUSF receives an authentication request message #1 sent by the AMF, where the authentication request message #1 carries SUCI.
- the AUSF generates an A-KID#1 based on the RID#1 in the SUCI.
- Steps 601-602 are similar to the aforementioned steps 501-502, and are not repeated here.
- the AUSF sends a first authentication request response to the AMF based on the authentication request message #1, where the first authentication request response carries the AKMA service indication information.
- the AUSF performs the authentication operation of the UE based on the authentication request message #1.
- the AUSF sends a first authentication request response to the AMF, and the first authentication request response carries indication information (indication) used to indicate that the UE supports the AKMA service, and the indication information (indication) can be the AUSF itself generate.
- the indication information can also be directly forwarded to the AMF from the indication information received from the UDM, such as sending the AKMA ID (or AKMA indication) to the AMF.
- the indication information may be indication information with a value of 0 or 1, for example, when the value is 1, it indicates that the AKMA service is supported, and when the value is 0, it indicates that the AKMA service is not supported.
- the value when the value is 1, it means that the AKMA service is supported, and when it does not appear, it means that the AKMA service is not supported. It can also be in string form "AKMA", or enumeration types ⁇ AKMA enable>, ⁇ AKMA disable>. It can indicate whether the AKMA service is supported by whether it appears, and can also indicate whether the AKMA service is supported by a specific meaning.
- the first authentication request response is "Nausf_UEAuthentication_Authenticate Response"
- the message carries an EAP-success message or carries indication information that informs the AMF whether the authentication to the UE is successful.
- the AMF determines whether the UE supports the AKMA service.
- the AMF After the AMF obtains the first authentication request response, the AMF saves the AKMA service indication information. For example, the association relationship between the AKMA service indication information and the SUPI of the UE is stored.
- the AUSF receives the authentication request message #2 sent by the AMF, where the authentication request message #2 carries the SUPI and the RID.
- the AMF Before the AMF sends the authentication request message #2 to the AUSF, the AMF checks whether the UE supports the AKMA service. If it is determined that the UE supports the AKMA service, the authentication request message #2 carries the RID#2. The RID#2 is determined by the AMF based on the SUPI of the UE. The AMF determines whether the UE supports the AKMA service based on whether the AKMA service indication information is stored locally. Specifically, if the AMF locally stores the AKMA service indication information, it is determined that the UE supports the AKMA service. If the AMF does not store the AKMA service indication information locally, it is determined that the UE does not support the AKMA service.
- step 606 is continued.
- the AMF determines the RID corresponding to the SUPI.
- AMF constructs SUCI based on this RID.
- the constructed SUCI#3 is carried in the authentication request message #2.
- the authentication request message #2 does not carry SUCI and RID.
- the AMF uses the HPLMN's public key and the UE's SUPI to generate SUCI#3 in the same manner as the UE.
- the AMF is required to locally store or obtain the necessary parameters for generating SUCI, such as the public key and public key identifier of the HPLMN.
- the authentication request message #2 is "Nausf_UEAuthentication_Authenticate request”.
- the AUSF sends a second authentication request response to the AMF, where the second authentication request response carries the AKMA service indication information.
- the AUSF After the AUSF completes the authentication operation of the UE based on the authentication request message #2, the AUSF sends a second authentication request response to the AMF, where the second authentication request response carries the AKMA service indication information.
- This method is also called explicit carrying. Explicit carrying means that the AKMA service indication information must be sent to the AMF every time, and the AMF will check whether the AKMA service indication information of the UE still exists. Some UE context information, or re-store AKMA service indication information. If the AKMA service indication information does not exist, the AMF may consider that the UE no longer supports the AKMA service, and may delete the AKMA service indication information in the UE context.
- the second authentication request response may not carry the AKMA service indication information.
- the AMF can be understood as the UE has always supported the AKMA service.
- the AUSF sends an AKMA service cancellation indication information, which indicates that the UE no longer supports the AKMA service.
- the AKMA service cancellation indication information may share one bit of information with the AKMA service indication information. For example, when the value is 0, it means that the UE does not support the AKMA service, and when the value is 1, it means that the UE supports the AKMA service.
- the AMF updates the UE context information and deletes the AKMA service indication information. This method can simplify the complexity of the message transmitted from the AUSF to the AMF, and at the same time reduce the complexity of the AMF processing.
- the AUSF When the authentication request message #2 carries SUPI and RID#3, the AUSF generates A-KID#2 based on the RID#3.
- the AUSF After step 607, further, the AUSF generates Kakma. To distinguish, the Kakma generated here is called Kakma-2.
- the AUSF may send A-KID#2, SUPI and Kakma-2 to the AAnF. Specifically, it can be sent to AAnF through "Naanf_AnchorKey_Register Request". After receiving the message, AAnF replies "Naanf_AKMA_Register Response" to AUSF.
- the AUSF can delete Kakma-2.
- the AMF may carry the RID in the authentication request message, and the AUSF obtains the RID from the authentication request message.
- the AUSF can use the RID to generate a new A-KID to ensure the successful execution of the AKMA process.
- the RID may also be provided by the UDM.
- FIG. 7 is a schematic diagram of an embodiment of another method for generating a key identifier in an embodiment of the present application.
- a method for generating a key identifier proposed by an embodiment of the present application includes:
- the AUSF receives an authentication request message #1 sent by the AMF, where the authentication request message #1 carries SUCI.
- Step 701 is similar to the foregoing step 501 and will not be repeated here.
- the AUSF sends an authentication vector acquisition request message #1 to the UDM, where the authentication vector acquisition request message #1 carries SUCI.
- the AUSF After the AUSF receives the authentication request message #1 sent by the AMF, the AUSF sends the authentication vector acquisition request message #1 to the UDM, and the authentication vector acquisition request message #1 carries the SUCI.
- the authentication vector acquisition request message #1 is used to acquire the RID#2.
- the authentication vector acquisition request message #1 is "Nudm_UE_Authentication_Get_Request”.
- the UDM sends an authentication vector acquisition response message #1 to the AUSF, and the authentication vector acquisition response message #1 does not carry the RID.
- the UDM After the UDM receives the authentication vector acquisition request message #1, the UDM sends the authentication vector acquisition response message #1 to the AUSF, and the authentication vector acquisition response message #1 does not carry the RID.
- the authentication vector acquisition response message #1 is "Nudm_UE_Authentication_Get_Response".
- the AUSF After the AUSF receives the authentication vector acquisition response message #1 from the UDM, the AUSF performs an authentication operation on the UE (the UE corresponding to the authentication request message #1). When the authentication is successful, the AUSF sends an authentication request response (authentication success) to the AMF.
- the authentication vector acquisition response message #1 also carries an authentication vector (authentication vector, AV).
- the authentication vector acquisition response message #1 also carries authentication and key management indication information AKMA indication.
- the authentication vector acquisition response message #1 is "Nudm_UE_Authentication_Get_Response".
- the AUSF sends an authentication request response (authentication success) to the AMF.
- the AUSF generates A-KID#1.
- Step 704 is similar to the aforementioned step 502 and will not be repeated here.
- the AUSF receives the authentication request message #2 sent by the AMF.
- the AUSF receives the authentication request message #2 sent by the AMF.
- the authentication request message #2 carries SUPI, and the process goes to step 706 .
- the AUSF may send the authentication vector acquisition request message #2 to the UDM, where the authentication vector acquisition request message #2 carries the SUPI.
- the authentication vector get request message #2 may be: "Nudm_UE_Authentication_Get_Request”.
- the UDM After the UDM receives the authentication vector acquisition request message #2 sent by the AUSF.
- the AUSF obtains the authentication and key management indication information carried in the response message #2 according to the authentication vector, and determines that the UE supports the AKMA service.
- the AUSF determines that the UE's A-KID needs to be generated.
- the UDM sends an authentication vector acquisition response message #2 to the AUSF, where the authentication vector acquisition response message #2 carries an authentication vector (authentication vector, AV).
- the authentication vector acquisition response message #2 does not carry the RID.
- the authentication vector acquisition response message #2 also carries authentication and key management indication information AKMA indication.
- the authentication vector acquisition response message #2 is "Nudm_UE_Authentication_Get_Response”.
- the AUSF After the AUSF receives the authentication vector acquisition response message #2 from the UDM, the AUSF performs an authentication operation on the UE (the UE corresponding to the authentication request message #2). When the authentication is successful, the AUSF sends an authentication request response (authentication success) to the AMF.
- AUSF generates Kakma based on the SUPI.
- the AUSF sends a second request to the UDM, where the second request carries the SUPI.
- the second request carries indication information that an RID is required.
- the AUSF After the AUSF receives the authentication request message #2, the AUSF sends a second request to the UDM, where the second request is used to request the RID #2 from the UDM.
- the AUSF sends the second request to the UDM.
- the AUSF sends the authentication request response to the AMF, that is, after the AUSF completes the authentication of the UE.
- the AUSF sends the second request to the UDM.
- the second request is "Nudm_UE_AKMA_Get_Request”.
- the AUSF After the AUSF receives the authentication request message #2 sent by the AMF, the AUSF detects whether the authentication request message #2 carries the RID #2. Optionally, the AUSF also detects whether the AUSF locally saves parameters related to RID#4 (for example, RID#4, SUCI and/or A-KID#1).
- RID#4 for example, RID#4, SUCI and/or A-KID#1.
- the AUSF sends a second request to the UDM, where the second request is used to request the RID.
- the second request carries the SUPI, and the SUPI is the SUPI carried in the authentication request message #2.
- the AUSF sends a second request to the UDM, and the second request is used to request the RID. .
- the second request carries indication information that an RID is required.
- the AUSF After the AUSF receives the authentication vector acquisition response message #2 sent by the UDM, after the AUSF determines that the UE supports the AKMA service, the AUSF does not receive the RID#3 in the authentication request message #2, and/or the AUSF does not locally If RID#4 is stored, the AUSF sends the second request to the UDM.
- step 706 after the AUSF receives the authentication request message #2 sent by the AMF, there are two optional implementation schemes, which are described below:
- the AUSF After each time the AUSF receives the authentication request message #2, it detects whether the authentication request message #2 carries the RID. Optionally, the AUSF also detects whether the AUSF locally saves parameters related to RID#4 (for example, RID#4, SUCI and/or A-KID#1). When the detection result is that there is no RID#3 in the authentication request message #2 (there is no RID in the authentication request message #2 and the AUSF has no local parameters related to RID#4), the AUSF sends a second request to the UDM. In step 708, the AUSF does not store the RID#1 carried in the second response from the UDM. That is, after each time the AUSF receives the authentication request message #2, it will detect whether the authentication request message #2 carries the RID#3, and if not, the AUSF sends the second request to the UDM.
- RID#4 for example, RID#4, SUCI and/or A-KID#1
- the AUSF After receiving the authentication request message #2, the AUSF detects whether the authentication request message #2 carries the RID. Optionally, the AUSF also detects whether the parameters related to RID#4 (for example, RID#4, SUCI and/or A-KID#1) are locally stored in the AUSF. When the detection result is that there is no RID#3 in the authentication request message #2 (or there is no RID#1 in the authentication request message #2, and the AUSF has no local parameters related to RID#4), the AUSF sends a second request to the UDM. In step 708, the AUSF saves the RID#2 carried in the second response from the UDM.
- RID#4 for example, RID#4, SUCI and/or A-KID#1
- the AUSF sends the second request to the UDM.
- the AUSF will save the RID#3 returned by the AMF based on the second request.
- the AUSF may perform subsequent actions based on the locally stored RID #4 (stored in step 708).
- the second request is "Nudm_UE_AKMA_Get_Request".
- the AUSF After the AUSF receives the authentication request message #2 sent by the AMF, the AUSF determines whether the authentication request message #2 carries the RID #3. If it carries RID#3, go to step 709.
- step 709 is executed.
- the UDM determines RID#2 based on the SUPI carried in the second request.
- the UDM After receiving the first request, the UDM determines the RID#2 corresponding to the SUPI based on the SUPI carried in the second request.
- the UDM sends a second response to the AUSF, where the second response carries RID#2.
- the UDM sends a second response to the AUSF, where the second response carries RID#2.
- the second response is "Nudm_UE_AKMA_Get_Response”.
- the AUSF When the SUPI is carried in the authentication request message #2, the AUSF generates an A-KID#2 based on the RID#2.
- AUSF is based on generating Kakma. To distinguish, the Kakma generated here is called Kakma-2.
- the AUSF may send A-KID#2, SUPI and Kakma-2 to the AAnF. Specifically, it can be sent to AAnF through "Naanf_AnchorKey_Register Request". After receiving the message, AAnF replies "Naanf_AKMA_Register Response" to AUSF.
- the AUSF may delete A-KID#2.
- the AUSF can delete Kakma-2.
- the AUSF may acquire the RID from the UDM. To ensure that when the authentication vector acquisition request message received by the AUSF carries the SUPI, the AUSF can use the RID to generate a new A-KID to ensure the successful execution of the AKMA process.
- FIG. 8 is a schematic diagram of an embodiment of another method for generating a key identifier in an embodiment of the present application.
- a method for generating a key identifier proposed by an embodiment of the present application includes:
- the AUSF receives an authentication request message #1 sent by the AMF, where the authentication request message #1 carries SUCI.
- the AUSF sends an authentication vector acquisition request message #1 to the UDM, where the authentication vector acquisition request message #1 carries SUCI.
- Steps 801-802 are similar to the aforementioned steps 701-702, and are not repeated here.
- the UDM determines RID#1 based on the SUCI carried in the authentication vector acquisition request message #1.
- the UDM After the UDM determines RID#1 based on the SUCI carried in the authentication vector acquisition request message #1, the UDM stores the RID#1, and the RID#1 stored in the UDM is called RID#2.
- the UDM stores RID#2 and the association relationship between RID#2 and SUPI.
- the UDM stores RID#2, SUCI, and the association relationship between RID#1 and SUCI. Further, the UDM stores the association relationship between RID#2 and SUCI and SUPI.
- the UDM stores SUCI, that is, the UDM does not store RID#2 independently. Further, the UDM stores SUCI and the association between SUCI and SUPI.
- the UDM may not store the RID#1 in step 803. Then, in step 805, the AUSF generates A-KID#1 based on the default value.
- the UDM sends an authentication vector acquisition response message #1 to the AUSF, and the authentication vector acquisition response message #1 carries the RID#2.
- the UDM After determining that the UE supports the AKMA service, the UDM carries the RID#2 in the authentication vector acquisition response message #1.
- the UDM sends an authentication vector acquisition response message #1 to the AUSF, where the authentication vector acquisition response message #1 carries the RID #2.
- the authentication vector acquisition response message #1 does not carry the RID.
- the AUSF may send the authentication vector acquisition request message #1 to the UDM, and the authentication vector acquisition request message #1 carries the SUCI.
- the authentication vector get request message #1 may be: "Nudm_UE_Authentication_Get_Request”.
- the UDM After the UDM receives the authentication vector acquisition request message #1 sent by the AUSF.
- the UDM sends an authentication vector acquisition response message #1 to the AUSF, and the authentication vector acquisition response message #1 carries the RID#2.
- the authentication vector acquisition response message #1 also carries an authentication vector (authentication vector, AV).
- the authentication vector acquisition response message #1 also carries authentication and key management indication information AKMA indication.
- the AUSF records that the UE supports the AKMA service, for example, the AUSF stores the AKMA indication. Further, AUSF stores the association relationship between AKMA indication and SUPI.
- the authentication vector acquisition response message #1 is "Nudm_UE_Authentication_Get_Response".
- the AUSF After the AUSF receives the authentication vector acquisition response message #1 from the UDM, the AUSF performs an authentication operation on the UE (the UE corresponding to the authentication request message #1). When the authentication is successful, the AUSF sends an authentication request response (authentication success) to the AMF.
- the AUSF generates A-KID#1 based on the RID.
- the AUSF After the AUSF receives the authentication request message #1, the AUSF generates an A-KID #1 based on the RID #1 in the SUCI in the authentication request message #1.
- the AUSF obtains the RID#2 carried in the response message #1 based on the authentication vector, and generates A-KID#1.
- AUSF is based on generating Kakma. To distinguish, the Kakma generated here is called Kakma-2.
- the AUSF may send the A-KID#1, SUPI and Kakma to the AAnF. Specifically, it can be sent to AAnF through "Naanf_AnchorKey_Register Request". After receiving the message, AAnF replies "Naanf_AKMA_Register Response" to AUSF.
- the AUSF receives the authentication request message #2 sent by the AMF.
- the authentication request message #2 is "Nausf_UEAuthentication_Authenticate Request”.
- the AUSF sends an authentication vector acquisition request message #2 to the UDM, where the authentication vector acquisition request message #2 carries SUPI.
- the AUSF After the AUSF receives the authentication request message #2, the AUSF sends the authentication vector acquisition request message #2 to the UDM, and the authentication vector acquisition request message #2 carries the SUPI.
- the authentication vector acquisition request message may be: "Nudm_UE_Authentication_Get_Request”.
- the authentication vector acquisition request message #2 carries indication information, and the indication information is used to request the UDM to issue the RID #2. Specifically, the AUSF checks whether there is a storage record that the UE supports the AKMA service, and if it is determined that the UE supports the AKMA service, the authentication vector acquisition request message #2 carries the indication information.
- the AUSF detects whether the authentication request message #2 carries the RID #3.
- the AUSF also detects whether the AUSF locally saves parameters related to RID#4 (for example, RID#4, SUCI and/or A-KID#1).
- the AUSF sends the authentication vector acquisition request message #2 to the UDM, and the authentication vector acquisition request message #2 is used to request authentication Weight vector and RID.
- the authentication vector acquisition request message #2 carries SUPI and indication information. The indication information is used to request the UDM to issue RID#2.
- the UDM determines RID#2 based on the SUPI carried in the authentication vector acquisition request message #2.
- the UDM After the UDM receives the authentication vector acquisition request message #2 sent by the AUSF.
- the UDM determines RID#2 based on the SUPI carried in the authentication vector acquisition request message #2.
- the UDM determines the RID#2 corresponding to the SUPI according to the indication information carried in the authentication vector acquisition request message #2.
- the UDM sends an authentication vector acquisition response message #2 to the AUSF, and the authentication vector acquisition response message #2 carries the RID #2.
- the UDM sends an authentication vector acquisition response message #2 to the AUSF, where the authentication vector acquisition response message #2 carries the RID #2.
- the authentication vector acquisition response message #2 also carries an authentication vector (authentication vector, AV).
- the authentication vector acquisition response message #2 also carries authentication and key management indication information AKMA indication.
- the authentication vector acquisition response message #2 is "Nudm_UE_Authentication_Get_Response".
- the AUSF After the AUSF receives the authentication vector acquisition response message #2 from the UDM, the AUSF performs an authentication operation on the UE (the UE corresponding to the authentication request message #1). When the authentication is successful, the AUSF sends an authentication request response (authentication success) to the AMF.
- the AUSF When the SUPI is carried in the authentication request message #2, the AUSF generates an A-KID#2 based on the RID#2 in the authentication vector acquisition response message #2.
- the AUSF When the authentication request message #2 carries SUPI, the AUSF generates A-KID #2 based on the RID #2 in the authentication vector acquisition response message #2.
- the RID#2 comes from the authentication vector acquisition response message #2 sent by the UDM.
- the AUSF may send A-KID#2, SUPI and Kakma-2 to the AAnF. Specifically, it can be sent to AAnF through "Naanf_AnchorKey_Register Request". After receiving the message, AAnF replies "Naanf_AKMA_Register Response" to AUSF.
- the communication apparatus includes corresponding hardware structures and/or software modules for executing each function.
- the present application can be implemented in hardware or in the form of a combination of hardware and computer software. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.
- the communication device may be divided into functional modules according to the foregoing method examples.
- each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
- the above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules. It should be noted that, the division of modules in the embodiments of the present application is schematic, and is only a logical function division, and there may be other division manners in actual implementation.
- the transceiver module 901 is configured to receive an authentication request message #1 from an access and mobility management function.
- the authentication request message #1 carries a subscription hidden identifier, and the subscription hidden identifier is a user generated based on the permanent identity of the terminal device. hidden logo;
- the transceiver module 901 is further configured to send an authentication vector acquisition request message #1 to the unified data management function, where the authentication vector acquisition request message #1 carries a subscription hidden identifier;
- a processing module 902 configured to generate the authentication and key management-key temporary identity identifier #1 based on the routing identifier in the contract hidden identifier according to the authentication and key management indication information;
- the processing module 902 is further configured to save the routing identifier.
- the transceiver module 901 is further configured to receive an authentication request message #2 from the access and mobility management function;
- the processing module 902 is further configured to generate a new authentication and key management-key temporary identity identifier #2 by using the saved routing identifier when the authentication request message #2 carries the permanent identity identifier.
- the processing module 902 is further configured to generate authentication and key management-key temporary identity based on the intermediate key generated in the authentication process for the terminal device;
- the processing module 902 is further configured to splicing the routing identifier and the authentication and key management-key temporary identifier to obtain the authentication and key management-key temporary identifier #1.
- the processing module 902 is further configured to save the authentication and key management-key temporary identity identifier #1.
- the authentication vector acquisition response message #1 also includes a routing identifier
- the processing module 902 is further configured to save the subscription hidden identifier.
- the processing module 902 is further configured to delete the authentication and key management-key temporary identity identifier #1.
- the processing module 902 is further configured to delete the authentication and key management-key temporary identity identifier #2;
- FIG. 10 is a schematic diagram of an embodiment of a communication device according to an embodiment of the present application.
- the communication apparatus can be deployed in the network equipment, and the communication apparatus includes:
- the transceiver module 1001 is further configured to send an authentication vector acquisition request message #1 to the unified data management function, where the authentication vector acquisition request message #1 carries a subscription hidden identifier;
- the processing module 1002 is configured to generate the authentication and key management-key temporary identity identifier #1 based on the routing identifier according to the authentication and key management indication information.
- the transceiver module 1001 is further configured to send an authentication vector acquisition request message #2 to the unified data management function, and the authentication vector acquisition request message #2 carries a permanent identity identifier;
- the transceiver module 1001 is further configured to receive an authentication vector acquisition response message #2 from the unified data management function, and the authentication vector acquisition response message #2 includes a routing identifier;
- the processing module 1002 is further configured to use the routing identifier to generate a new authentication and key management-key temporary identifier #2.
- the transceiver module 1001 is further configured to receive an authentication request message #2 from the access and mobility management function; the authentication request message #2 includes a permanent identity identifier;
- the transceiver module 1001 is further configured to send an authentication vector acquisition request message #2 to the unified data management function, and the authentication vector acquisition request message #2 carries a permanent identity identifier;
- the processing module 1002 is further configured to determine, according to the authentication and key management indication information, that authentication and key management-key temporary identity identifier #2 needs to be generated;
- the transceiver module 1001 is further configured to obtain the routing identifier from the core network element when the authentication management function does not have the routing identifier locally.
- the core network element includes a unified data management function or an access and mobility management function.
- the transceiver module 1001 is further configured to receive an authentication vector acquisition response message #2 from the unified data management function, where the authentication vector acquisition response message #2 includes authentication and key management indication information.
- the transceiver module 1101 is configured to receive an authentication request message #1 from the access and mobility management function, where the authentication request message #1 carries a subscription hidden identifier, and the subscription hidden identifier is generated based on the permanent identity of the terminal device User hidden identity;
- the transceiver module 1101 is further configured to send an authentication vector acquisition request message #1 to the unified data management function, where the authentication vector acquisition request message #1 carries a subscription hidden identifier;
- the transceiver module 1101 is further configured to receive an authentication request message #2 from the access and mobility management function; wherein, the authentication request message #2 includes a permanent identity identifier and a routing identifier;
- the transceiver module 1101 is further configured to send an authentication vector acquisition request message #2 to the unified data management function, wherein the authentication vector acquisition request message #2 carries a permanent identity identifier;
- the transceiver module 1101 is further configured to send a first authentication request response to the access and mobility management function; the first authentication request response includes first indication information, and the first indication information is used for Indicates that the terminal device supports the authentication and key management services of the application.
- the processing module 1102 is further configured to generate authentication and key management-key temporary identity identifier #1 based on the routing identifier in the authentication vector acquisition response message #1.
- FIG. 12 is a schematic diagram of an embodiment of a communication device according to an embodiment of the present application.
- the communication apparatus can be deployed in the network equipment, and the communication apparatus includes:
- the transceiver module 1201 is further configured to send an authentication vector acquisition request message #2 to the unified data management function, and the authentication vector acquisition request message #2 carries a permanent identity identifier;
- the transceiver module 1201 is further configured to receive an authentication vector acquisition response message #2 from the unified data management function, and the authentication vector acquisition response message #2 includes authentication and key management indication information;
- the processing module 1202 is further configured to determine that authentication and key management-key temporary identity needs to be generated according to the authentication and key management indication information;
- the processing module 1202 is further configured to use the routing identifier to generate authentication and key management-key temporary identifier #2.
- the core network element includes a unified data management function or an access and mobility management function.
- the above-mentioned communication apparatus may further include a storage unit for storing data and/or instructions (also referred to as codes or programs).
- the foregoing units may interact or be coupled with the storage unit to implement corresponding methods or functions.
- the processing module 1202 may read data or instructions in the storage unit, so that the communication apparatus implements the methods in the above embodiments.
- the coupling in the embodiments of the present application is an indirect coupling or communication connection between devices, units or modules, which may be in electrical, mechanical or other forms, and is used for information exchange between devices, units or modules.
- each functional module in each embodiment of this application may be integrated into one processing unit. In the device, it can also exist physically alone, or two or more modules can be integrated into one module.
- the above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules.
- the present application also provides a communication system, which includes at least one or more of a network device or a terminal device.
- Embodiments of the present application further provide a computer-readable storage medium, including instructions, which, when run on a computer, enable the computer to control a network device or a terminal device to execute any one of the implementations shown in the foregoing method embodiments.
- An embodiment of the present application also provides a computer program product, the computer program product includes computer program code, and when the computer program code runs on a computer, the computer can execute any one of the implementations shown in the foregoing method embodiments.
- Embodiments of the present application further provide a chip system, including a processor, where the processor is configured to call and run a computer program, so that the chip executes any one of the implementations shown in the foregoing method embodiments.
- the technical solutions provided in the embodiments of the present application may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
- software When implemented in software, it can be implemented in whole or in part in the form of a computer program product.
- the computer program product includes one or more computer instructions.
- the computer may be a general-purpose computer, a special-purpose computer, a computer network, an AI node, an access network device, a terminal device, or other programmable devices.
- the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, optical fiber, digital subscriber line, DSL) or wireless (eg, infrared, wireless, microwave, etc.).
- the computer-readable storage medium can be any available media that can be accessed by a computer, or a data storage device such as a server, data center, etc. that includes one or more available media integrated.
- the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, digital video discs (DVDs)), or semiconductor media, and the like.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Mobile Radio Communication Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Lock And Its Accessories (AREA)
- Telephonic Communication Services (AREA)
Abstract
Description
Claims (51)
- 一种密钥标识的生成方法,其特征在于,包括:鉴权管理功能接收来自接入与移动性管理功能的鉴权请求消息#1,所述鉴权请求消息#1中携带签约隐藏标识符,所述签约隐藏标识符为基于终端设备的永久身份标识生成的用户隐藏标识;所述鉴权管理功能向统一数据管理功能发送鉴权向量获取请求消息#1,所述鉴权向量获取请求消息#1中携带所述签约隐藏标识符;所述鉴权管理功能接收来自所述统一数据管理功能的鉴权向量获取响应消息#1,所述鉴权向量获取响应消息#1包括认证和密钥管理指示信息;根据所述认证和密钥管理指示信息,所述鉴权管理功能基于所述签约隐藏标识符中的路由标识生成认证和密钥管理-密钥临时身份标识#1;所述鉴权管理功能保存所述路由标识。
- 根据权利要求1所述的方法,其特征在于,所述方法还包括:所述鉴权管理功能接收来自所述接入与移动性管理功能的鉴权请求消息#2;在所述鉴权请求消息#2中携带所述永久身份标识的情况下,所述鉴权管理功能使用所述保存的路由标识生成新的认证和密钥管理-密钥临时身份标识#2。
- 根据权利要求1或2所述的方法,其特征在于,所述鉴权管理功能基于所述签约隐藏标识符中的所述路由标识生成所述认证和密钥管理-密钥临时身份标识#1,包括:所述鉴权管理功能基于对所述终端设备进行鉴权流程中生成的中间密钥,生成认证和密钥管理-终端设备临时标识;所述鉴权管理功能将所述路由标识和所述认证和密钥管理-终端设备临时标识获得所述认证和密钥管理-密钥临时身份标识#1。
- 根据权利要求3所述的方法,其特征在于,所述鉴权管理功能保存所述路由标识,包括:所述鉴权管理功能保存所述认证和密钥管理-密钥临时身份标识#1。
- 根据权利要求1或2所述的方法,其特征在于,所述鉴权向量获取响应消息#1中还包括所述路由标识;所述鉴权管理功能基于所述签约隐藏标识符中的所述路由标识生成所述认证和密钥管理-密钥临时身份标识#1,包括:所述鉴权管理功能基于所述鉴权向量获取响应消息#1中的所述路由标识生成所述认证和密钥管理-密钥临时身份标识#1。
- 根据权利要求1或2所述的方法,其特征在于,所述鉴权管理功能保存所述路由标识,包括:所述鉴权管理功能保存所述签约隐藏标识符。
- 根据权利要求1-6中任一项所述的方法,其特征在于,所述鉴权管理功能保存所述路由标识之后,所述方法还包括:所述鉴权管理功能向删除所述认证和密钥管理-密钥临时身份标识#1。
- 根据权利要求2-7中任一项所述的方法,其特征在于,所述鉴权管理功能基于所述保存的路由标识生成所述认证和密钥管理-密钥临时身份标识#2之后,所述方法还包括:所述鉴权管理功能删除所述认证和密钥管理-密钥临时身份标识#2;所述鉴权管理功能继续保存所述路由标识。
- 一种密钥标识的生成方法,其特征在于,包括:鉴权管理功能接收来自接入与移动性管理功能的鉴权请求消息#1,所述鉴权请求消息#1中携带签约隐藏标识符,所述签约隐藏标识符为基于终端设备的永久身份标识生成的用户隐藏标识;所述鉴权管理功能向统一数据管理功能发送鉴权向量获取请求消息#1,所述鉴权向量获取请求消息#1中携带所述签约隐藏标识符;所述鉴权管理功能接收来自所述统一数据管理功能的鉴权向量获取响应消息#1,所述鉴权向量获取响应消息#1包括认证和密钥管理指示信息和所述签约隐藏标识符中的路由标识;根据所述认证和密钥管理指示信息,所述鉴权管理功能基于所述路由标识生成认证和密钥管理-密钥临时身份标识#1。
- 根据权利要求9所述的方法,其特征在于,所述方法还包括:所述鉴权管理功能接收来自所述接入与移动性管理功能的鉴权请求消息#2;所述鉴权请求消息#2包括所述永久身份标识;所述鉴权管理功能向所述统一数据管理功能发送鉴权向量获取请求消息#2,所述鉴权向量获取请求消息#2中携带所述永久身份标识;所述鉴权管理功能接收来自所述统一数据管理功能的鉴权向量获取响应消息#2,所述鉴权向量获取响应消息#2包括所述路由标识;所述鉴权管理功能使用所述路由标识生成新的认证和密钥管理-密钥临时身份标识#2。
- 根据权利要求9所述的方法,其特征在于,所述方法还包括:所述鉴权管理功能接收来自所述接入与移动性管理功能的鉴权请求消息#2;所述鉴权请求消息#2包括所述永久身份标识;所述鉴权管理功能向所述统一数据管理功能发送鉴权向量获取请求消息#2,所述鉴权向量获取请求消息#2中携带所述永久身份标识;所述鉴权管理功能根据所述认证和密钥管理指示信息,从核心网网元获取所述路由标识;所述鉴权管理功能使用所述路由标识生成新的认证和密钥管理-密钥临时身份标识#2。
- 根据权利要求11所述的方法,其特征在于,所述鉴权管理功能根据所述认证和密钥管理指示信息,从其他核心网网元获取所述路由标识,包括:所述鉴权管理功能根据所述认证和密钥管理指示信息,确定需要生成所述认证和密钥管理-密钥临时身份标识#2;在所述鉴权管理功能本地没有所述路由标识的情况下,所述鉴权管理功能从所述核心网网元获取所述路由标识。
- 根据权利要求11或12所述的方法,其特征在于,所述核心网网元包括所述统一数据管理功能或者所述接入与移动性管理功能。
- 根据权利要求11所述的方法,其特征在于,在所述鉴权管理功能根据所述认证和密钥管理指示信息,从所述核心网网元获取路由标识之前,所述方法还包括:所述鉴权管理功能接收来自所述统一数据管理功能的鉴权向量获取响应消息#2,所述鉴权向量获取响应消息#2包括所述认证和密钥管理指示信息。
- 一种密钥标识的生成方法,其特征在于,包括:鉴权管理功能接收来自接入与移动性管理功能的鉴权请求消息#1,所述鉴权请求消息#1中携带签约隐藏标识符,所述签约隐藏标识符为基于终端设备的永久身份标识生成的用户隐藏标识;所述鉴权管理功能向统一数据管理功能发送鉴权向量获取请求消息#1,所述鉴权向量获取请求消息#1中携带所述签约隐藏标识符;所述鉴权管理功能接收来自所述统一数据管理功能的鉴权向量获取响应消息#1,所述鉴权向量获取响应消息#1包括认证和密钥管理指示信息;根据所述认证和密钥管理指示信息,所述鉴权管理功能基于所述签约隐藏标识符中的路由标识生成认证和密钥管理-密钥临时身份标识#1;所述鉴权管理功能接收来自所述接入与移动性管理功能的鉴权请求消息#2;其中,所述鉴权请求消息#2包括所述永久身份标识和所述路由标识;所述鉴权管理功能使用从所述接入与移动性管理功能接收到的所述路由标识生成新的认证和密钥管理-密钥临时身份标识#2。
- 根据权利要求15所述的方法,其特征在于,在所述鉴权管理功能使用从所述接入与移动性管理功能接收到的所述路由标识生成新的所述认证和密钥管理-密钥临时身份标识#2之前,所述方法还包括:所述鉴权管理功能向所述统一数据管理功能发送鉴权向量获取请求消息#2,其中,所述鉴权向量获取请求消息#2中携带所述永久身份标识;所述鉴权管理功能接收来自所述统一数据管理功能的鉴权向量获取响应消息#2。
- 根据权利要求15或16所述的方法,其特征在于,在所述鉴权管理功能接收来自所述接入与移动性管理功能的所述鉴权请求消息#2之前,所述方法还包括:所述鉴权管理功能向所述接入与移动性管理功能发送第一鉴权请求响应;所述第一鉴权请求响应包括第一指示信息,所述第一指示信息用于指示所述终端设备支持应用的认证和密钥管理业务。
- 根据权利要求15-17任一所述的方法,其特征在于,所述鉴权向量获取响应消息#1中还包括所述路由标识;所述鉴权管理功能基于所述签约隐藏标识符中的所述路由标识生成所述认证和密钥管理-密钥临时身份标识#1,包括:所述鉴权管理功能基于所述鉴权向量获取响应消息#1中的所述路由标识生成所述认证和密钥管理-密钥临时身份标识#1。
- 一种密钥标识的生成方法,其特征在于,包括:鉴权管理功能接收来自接入与移动性管理功能的鉴权请求消息#2;所述鉴权请求消息#2包括永久身份标识;所述鉴权管理功能向统一数据管理功能发送鉴权向量获取请求消息#2,所述鉴权向量获取请求消息#2中携带所述永久身份标识;所述鉴权管理功能接收来自所述统一数据管理功能的鉴权向量获取响应消息#2,所述鉴权向量获取响应消息#2包括认证和密钥管理指示信息;所述鉴权管理功能根据所述认证和密钥管理指示信息,确定需要生成认证和密钥管理-密钥临时身份标识;在所述鉴权管理功能本地没有路由标识的情况下,所述鉴权管理功能从核心网网元获取所述路由标识;所述鉴权管理功能使用所述路由标识生成认证和密钥管理-密钥临时身份标识#2。
- 根据权利要求19所述的方法,其特征在于,所述核心网网元包括所述统一数据管理功能或者所述接入与移动性管理功能。
- 一种通信装置,其特征在于,包括:收发模块,用于接收来自接入与移动性管理功能的鉴权请求消息#1,所述鉴权请求消息#1中携带签约隐藏标识符,所述签约隐藏标识符为基于终端设备的永久身份标识生成的用户隐藏标识;所述收发模块,还用于向统一数据管理功能发送鉴权向量获取请求消息#1,所述鉴权向量获取请求消息#1中携带所述签约隐藏标识符;所述收发模块,还用于接收来自所述统一数据管理功能的鉴权向量获取响应消息#1,所述鉴权向量获取响应消息#1包括认证和密钥管理指示信息;处理模块,用于根据所述认证和密钥管理指示信息,基于所述签约隐藏标识符中的路由标识生成认证和密钥管理-密钥临时身份标识#1;所述处理模块,还用于保存所述路由标识。
- 根据权利要求21所述的通信装置,其特征在于,所述收发模块,还用于接收来自所述接入与移动性管理功能的鉴权请求消息#2;所述处理模块,还用于在所述鉴权请求消息#2中携带所述永久身份标识的情况下,使用所述保存的路由标识生成新的认证和密钥管理-密钥临时身份标识#2。
- 根据权利要求21或22所述的通信装置,其特征在于,所述处理模块,还用于基于对所述终端设备进行鉴权流程中生成的中间密钥,生成认证和密钥管理-终端设备临时标识;所述处理模块,还用于将所述路由标识和所述认证和密钥管理-终端设备临时标识获得所述认证和密钥管理-密钥临时身份标识#1。
- 根据权利要求23所述的通信装置,其特征在于,所述处理模块,还用于保存所述认证和密钥管理-密钥临时身份标识#1。
- 根据权利要求21或22所述的通信装置,其特征在于,所述鉴权向量获取响应消 息#1中还包括所述路由标识;所述处理模块,还用于基于所述签约隐藏标识符中的所述路由标识生成所述认证和密钥管理-密钥临时身份标识#1,包括:所述处理模块,还用于基于所述鉴权向量获取响应消息#1中的所述路由标识生成所述认证和密钥管理-密钥临时身份标识#1。
- 根据权利要求21或22所述的通信装置,其特征在于,所述处理模块,还用于保存所述签约隐藏标识符。
- 根据权利要求21-26中任一项所述的通信装置,其特征在于,所所述处理模块,还用于删除所述认证和密钥管理-密钥临时身份标识#1。
- 根据权利要求22-27中任一项所述的通信装置,其特征在于,所述处理模块,还用于删除所述认证和密钥管理-密钥临时身份标识#2;所述处理模块,还用于继续保存所述路由标识。
- 一种通信装置,其特征在于,包括:收发模块,用于接收来自接入与移动性管理功能的鉴权请求消息#1,所述鉴权请求消息#1中携带签约隐藏标识符,所述签约隐藏标识符为基于终端设备的永久身份标识生成的用户隐藏标识;所述收发模块,还用于向统一数据管理功能发送鉴权向量获取请求消息#1,所述鉴权向量获取请求消息#1中携带所述签约隐藏标识符;所述收发模块,还用于接收来自所述统一数据管理功能的鉴权向量获取响应消息#1,所述鉴权向量获取响应消息#1包括认证和密钥管理指示信息和所述签约隐藏标识符中的路由标识;处理模块,用于根据所述认证和密钥管理指示信息,基于所述路由标识生成认证和密钥管理-密钥临时身份标识#1。
- 根据权利要求29所述的通信装置,其特征在于,所述收发模块,还用于接收来自所述接入与移动性管理功能的鉴权请求消息#2;所述鉴权请求消息#2包括所述永久身份标识;所述收发模块,还用于向所述统一数据管理功能发送鉴权向量获取请求消息#2,所述鉴权向量获取请求消息#2中携带所述永久身份标识;所述收发模块,还用于接收来自所述统一数据管理功能的鉴权向量获取响应消息#2,所述鉴权向量获取响应消息#2包括所述路由标识;所述处理模块,还用于使用所述路由标识生成新的认证和密钥管理-密钥临时身份标识#2。
- 根据权利要求29所述的通信装置,其特征在于,所述收发模块,还用于接收来自所述接入与移动性管理功能的鉴权请求消息#2;所述鉴权请求消息#2包括所述永久身份标识;所述收发模块,还用于向所述统一数据管理功能发送鉴权向量获取请求消息#2,所述鉴权向量获取请求消息#2中携带所述永久身份标识;所述收发模块,还用于根据所述认证和密钥管理指示信息,从核心网网元获取所述路由标识;所述处理模块,还用于使用所述路由标识生成新的认证和密钥管理-密钥临时身份标识#2。
- 根据权利要求31所述的通信装置,其特征在于,所述处理模块,还用于根据所述认证和密钥管理指示信息,确定需要生成所述认证和密钥管理-密钥临时身份标识#2;所述收发模块,还用于在鉴权管理功能本地没有所述路由标识的情况下,从所述核心网网元获取所述路由标识。
- 根据权利要求31或32所述的通信装置,其特征在于,所述核心网网元包括所述统一数据管理功能或者所述接入与移动性管理功能。
- 根据权利要求31所述的通信装置,其特征在于,所述收发模块,还用于接收来自所述统一数据管理功能的鉴权向量获取响应消息#2,所述鉴权向量获取响应消息#2包括所述认证和密钥管理指示信息。
- 一种通信装置,其特征在于,包括:收发模块,用于接收来自接入与移动性管理功能的鉴权请求消息#1,所述鉴权请求消息#1中携带签约隐藏标识符,所述签约隐藏标识符为基于终端设备的永久身份标识生成的用户隐藏标识;所述收发模块,还用于向统一数据管理功能发送鉴权向量获取请求消息#1,所述鉴权向量获取请求消息#1中携带所述签约隐藏标识符;所述收发模块,还用于接收来自所述统一数据管理功能的鉴权向量获取响应消息#1,所述鉴权向量获取响应消息#1包括认证和密钥管理指示信息;处理模块,用于根据所述认证和密钥管理指示信息,基于所述签约隐藏标识符中的路由标识生成认证和密钥管理-密钥临时身份标识#1;所述收发模块,还用于接收来自所述接入与移动性管理功能的鉴权请求消息#2;其中,所述鉴权请求消息#2包括所述永久身份标识和路由标识;所述处理模块,还用于使用从所述接入与移动性管理功能接收到的所述路由标识生成新的认证和密钥管理-密钥临时身份标识#2。
- 根据权利要求35所述的通信装置,其特征在于,所述收发模块,还用于向所述统一数据管理功能发送鉴权向量获取请求消息#2,其中,所述鉴权向量获取请求消息#2中携带所述永久身份标识;所述收发模块,还用于接收来自所述统一数据管理功能的鉴权向量获取响应消息#2。
- 根据权利要求35或36所述的通信装置,其特征在于,所述收发模块,还用于向所述接入与移动性管理功能发送第一鉴权请求响应;所述第一鉴权请求响应包括第一指示信息,所述第一指示信息用于指示所述终端设备支持应用的认证和密钥管理业务。
- 根据权利要求35-37任一所述的通信装置,其特征在于,所述处理模块,还用于基于所述鉴权向量获取响应消息#1中的所述路由标识生成所述认证和密钥管理-密钥临时身份标识#1。
- 一种通信装置,其特征在于,包括:收发模块,用于接收来自接入与移动性管理功能的鉴权请求消息#2;所述鉴权请求消息#2包括永久身份标识;所述收发模块,还用于向所述统一数据管理功能发送鉴权向量获取请求消息#2,所述鉴权向量获取请求消息#2中携带所述永久身份标识;所述收发模块,还用于接收来自所述统一数据管理功能的鉴权向量获取响应消息#2,所述鉴权向量获取响应消息#2包括认证和密钥管理指示信息;所述处理模块,还用于根据所述认证和密钥管理指示信息,确定需要生成认证和密钥管理-密钥临时身份标识;所述收发模块,还用于在所述鉴权管理功能本地没有路由标识的情况下,从核心网网元获取所述路由标识;所述处理模块,还用于使用所述路由标识生成认证和密钥管理-密钥临时身份标识#2。
- 根据权利要求39所述的通信装置,其特征在于,所述核心网网元包括所述统一数据管理功能或者所述接入与移动性管理功能。
- 一种通信装置,其特征在于,所述通信装置包括:处理器;所述处理器,用于执行存储器中存储的计算机程序或指令,以使所述通信装置执行如权利要求1-8中任一项所述的方法。
- 一种通信装置,其特征在于,所述通信装置包括:处理器;所述处理器,用于执行存储器中存储的计算机程序或指令,以使所述通信装置执行如权利要求9-14中任一项所述的方法。
- 一种通信装置,其特征在于,所述通信装置包括:处理器;所述处理器,用于执行存储器中存储的计算机程序或指令,以使所述通信装置执行如权利要求15-18中任一项所述的方法。
- 一种通信装置,其特征在于,所述通信装置包括:处理器;所述处理器,用于执行存储器中存储的计算机程序或指令,以使所述通信装置执行如权利要求19-20中任一项所述的方法。
- 一种通信系统,其特征在于,包括:权利要求21-28中任一项所述的通信装置和权利要求41所述的通信装置。
- 一种通信系统,其特征在于,包括:权利要求29-34中任一项所述的通信装置和权利要求42所述的通信装置。
- 一种通信系统,其特征在于,包括:权利要求35-38中任一项所述的通信装置和权利要求43所述的通信装置。
- 一种通信系统,其特征在于,包括:权利要求39-40中任一项所述的通信装置和权利要求44所述的通信装置。
- 一种计算机可读存储介质,其特征在于,所述计算机可读存储介质具有程序指令, 当所述程序指令被直接或者间接执行时,使得如权利要求1-7,权利要求8-15,权利要求9-14,权利要求15-18,和/或权利要求19-20中任一所述的方法被实现。
- 一种芯片系统,其特征在于,所述芯片系统包括至少一个处理器,所述处理器用于执行存储器中存储的计算机程序或指令,当所述计算机程序或所述指令在所述至少一个处理器中执行时,使得如权利要求1-7,权利要求8-15,权利要求9-14,权利要求15-18,和/或权利要求19-20中任一所述的方法被实现。
- 一种计算机程序产品,其特征在于,包括指令,当所述指令在计算机上运行时,使得计算机执行权利要求1-7,权利要求8-15,权利要求9-14,权利要求15-18,和/或权利要求19-20中任一项所述的方法。
Priority Applications (7)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/CN2021/070980 WO2022147804A1 (zh) | 2021-01-08 | 2021-01-08 | 一种密钥标识的生成方法以及相关装置 |
EP21916859.8A EP4262260A4 (en) | 2021-01-08 | 2021-01-08 | METHOD FOR GENERATING A KEY IDENTIFIER AND ASSOCIATED APPARATUS |
CA3204536A CA3204536A1 (en) | 2021-01-08 | 2021-01-08 | Key identifier generation method and related apparatus |
AU2021417277A AU2021417277B2 (en) | 2021-01-08 | 2021-01-08 | Key identifier generation method, and related apparatus |
CN202180089268.5A CN116746181A (zh) | 2021-01-08 | 2021-01-08 | 一种密钥标识的生成方法以及相关装置 |
TW111100691A TWI799064B (zh) | 2021-01-08 | 2022-01-07 | 一種金鑰標識的生成方法以及相關裝置 |
US18/348,834 US20230362636A1 (en) | 2021-01-08 | 2023-07-07 | Key identifier generation method and related apparatus |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/CN2021/070980 WO2022147804A1 (zh) | 2021-01-08 | 2021-01-08 | 一种密钥标识的生成方法以及相关装置 |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US18/348,834 Continuation US20230362636A1 (en) | 2021-01-08 | 2023-07-07 | Key identifier generation method and related apparatus |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2022147804A1 true WO2022147804A1 (zh) | 2022-07-14 |
Family
ID=82357612
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2021/070980 WO2022147804A1 (zh) | 2021-01-08 | 2021-01-08 | 一种密钥标识的生成方法以及相关装置 |
Country Status (7)
Country | Link |
---|---|
US (1) | US20230362636A1 (zh) |
EP (1) | EP4262260A4 (zh) |
CN (1) | CN116746181A (zh) |
AU (1) | AU2021417277B2 (zh) |
CA (1) | CA3204536A1 (zh) |
TW (1) | TWI799064B (zh) |
WO (1) | WO2022147804A1 (zh) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN115320428A (zh) * | 2022-07-15 | 2022-11-11 | 浙江晨泰科技股份有限公司 | 一种电动汽车充电桩的充电控制方法及装置 |
WO2024092444A1 (zh) * | 2022-10-31 | 2024-05-10 | 华为技术有限公司 | 一种通信的方法和装置 |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN116886541B (zh) * | 2023-08-04 | 2024-07-19 | 中国联合网络通信有限公司深圳市分公司 | 一种业务宽带5gcpe保护和带宽实时分配方法及系统 |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20190174449A1 (en) * | 2018-02-09 | 2019-06-06 | Intel Corporation | Technologies to authorize user equipment use of local area data network features and control the size of local area data network information in access and mobility management function |
CN111147421A (zh) * | 2018-11-02 | 2020-05-12 | 中兴通讯股份有限公司 | 一种基于通用引导架构gba的认证方法及相关设备 |
WO2020098974A1 (en) * | 2018-11-14 | 2020-05-22 | Telefonaktiebolaget Lm Ericsson (Publ) | Methods and apparatuses for network function selection in 5g for a user |
Family Cites Families (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
TW201946485A (zh) * | 2018-03-21 | 2019-12-01 | 新加坡商 聯發科技(新加坡)私人有限公司 | 處理5g系統位置資訊之使用者設備及其方法 |
CN111147231B (zh) * | 2018-11-05 | 2022-03-11 | 华为技术有限公司 | 一种密钥协商的方法、相关装置及系统 |
-
2021
- 2021-01-08 CN CN202180089268.5A patent/CN116746181A/zh active Pending
- 2021-01-08 EP EP21916859.8A patent/EP4262260A4/en active Pending
- 2021-01-08 CA CA3204536A patent/CA3204536A1/en active Pending
- 2021-01-08 WO PCT/CN2021/070980 patent/WO2022147804A1/zh active Application Filing
- 2021-01-08 AU AU2021417277A patent/AU2021417277B2/en active Active
-
2022
- 2022-01-07 TW TW111100691A patent/TWI799064B/zh active
-
2023
- 2023-07-07 US US18/348,834 patent/US20230362636A1/en active Pending
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20190174449A1 (en) * | 2018-02-09 | 2019-06-06 | Intel Corporation | Technologies to authorize user equipment use of local area data network features and control the size of local area data network information in access and mobility management function |
CN111147421A (zh) * | 2018-11-02 | 2020-05-12 | 中兴通讯股份有限公司 | 一种基于通用引导架构gba的认证方法及相关设备 |
WO2020098974A1 (en) * | 2018-11-14 | 2020-05-22 | Telefonaktiebolaget Lm Ericsson (Publ) | Methods and apparatuses for network function selection in 5g for a user |
Non-Patent Citations (3)
Title |
---|
3GPP TS 33.501 |
See also references of EP4262260A4 |
ZTE: "Clarification of RID in the clause 6.1", 3GPP DRAFT; S3-202901, vol. SA WG3, 30 October 2020 (2020-10-30), pages 1 - 3, XP051949478 * |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN115320428A (zh) * | 2022-07-15 | 2022-11-11 | 浙江晨泰科技股份有限公司 | 一种电动汽车充电桩的充电控制方法及装置 |
CN115320428B (zh) * | 2022-07-15 | 2023-11-17 | 浙江晨泰科技股份有限公司 | 一种电动汽车充电桩的充电控制方法及装置 |
WO2024092444A1 (zh) * | 2022-10-31 | 2024-05-10 | 华为技术有限公司 | 一种通信的方法和装置 |
Also Published As
Publication number | Publication date |
---|---|
AU2021417277B2 (en) | 2024-07-04 |
CA3204536A1 (en) | 2022-07-14 |
TW202228415A (zh) | 2022-07-16 |
US20230362636A1 (en) | 2023-11-09 |
TWI799064B (zh) | 2023-04-11 |
EP4262260A4 (en) | 2023-12-20 |
CN116746181A (zh) | 2023-09-12 |
EP4262260A1 (en) | 2023-10-18 |
AU2021417277A1 (en) | 2023-07-27 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2022147804A1 (zh) | 一种密钥标识的生成方法以及相关装置 | |
US20220337995A1 (en) | Apparatus and method for providing subscription data to non-subscriber registered terminal in wireless communication system | |
CN113748697B (zh) | 用于提供非接入层(nas)消息保护的方法和系统 | |
US11871223B2 (en) | Authentication method and apparatus and device | |
CN105722058A (zh) | 用户设备和信息转发方法 | |
WO2021136211A1 (zh) | 授权结果的确定方法及装置 | |
US20220086145A1 (en) | Secondary Authentication Method And Apparatus | |
US20230048066A1 (en) | Slice authentication method and apparatus | |
US20230132454A1 (en) | Method and apparatus for supporting edge computing service for roaming ue in wireless communication system | |
CN114071639A (zh) | 接入网络的方法、通信系统和通信装置 | |
WO2021063164A1 (zh) | 通信方法、通信装置及存储介质 | |
CN114600487B (zh) | 身份认证方法及通信装置 | |
WO2023016160A1 (zh) | 一种会话建立方法和相关装置 | |
CN112567812B (zh) | 用于移动设备的位置报告 | |
WO2022228455A1 (zh) | 一种通信方法以及相关装置 | |
CN116709467A (zh) | 一种接入通信网络的方法和装置 | |
CN113904781B (zh) | 切片认证方法及系统 | |
WO2023213191A1 (zh) | 安全保护方法及通信装置 | |
WO2024032226A1 (zh) | 通信方法和通信装置 | |
US20240179519A1 (en) | Communication method and related apparatus | |
US20230336992A1 (en) | Method and apparatus for authenticating user equipment in wireless communication system | |
WO2023160624A1 (zh) | 一种通信方法及装置 | |
US20240244107A1 (en) | Method for determining application server | |
WO2024104246A1 (zh) | 通信方法和通信装置 | |
KR20230043969A (ko) | 접속 제어 방법, 장치 및 통신기기 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 21916859 Country of ref document: EP Kind code of ref document: A1 |
|
ENP | Entry into the national phase |
Ref document number: 3204536 Country of ref document: CA |
|
WWE | Wipo information: entry into national phase |
Ref document number: 202180089268.5 Country of ref document: CN |
|
WWE | Wipo information: entry into national phase |
Ref document number: 202317046304 Country of ref document: IN |
|
ENP | Entry into the national phase |
Ref document number: 2021916859 Country of ref document: EP Effective date: 20230710 |
|
ENP | Entry into the national phase |
Ref document number: 2021417277 Country of ref document: AU Date of ref document: 20210108 Kind code of ref document: A |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
WWE | Wipo information: entry into national phase |
Ref document number: 11202305208S Country of ref document: SG |